Bitbucket Audit: Unauthorized Full Data Export Triggered

title: "Bitbucket Audit: Unauthorized Full Data Export Triggered"
id: 9805128a-efa4-4a5f-8fed-7fef931b14dd
status: test
description: This rule identifies Bitbucket audit events where an unauthorized actor triggers a full data export. Full export capability can expose sensitive repository data, so unauthorized initiation is a high-risk sign of attempted data exfiltration. It relies on Bitbucket audit log telemetry matching the audit category and action for this specific event.
references:
  - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
  - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
  - attack.collection
  - attack.resource-development
  - attack.t1213.003
  - attack.t1586
logsource:
  product: bitbucket
  service: audit
  definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
  selection:
    auditType.category: Data pipeline
    auditType.action: Unauthorized full data export triggered
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 34d81081-03c9-4a7f-91c9-5e46af625cde
    type: derived