Bitbucket Audit: Unauthorized Full Data Export Triggered (Data Pipeline)
Flags Bitbucket audit events indicating an unauthorized user attempted a full data export.
FreeReviewedSigma · Critical · v5
- Product
- bitbucket
- Service
- audit
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2024-02-25
- Updated
- 2026-07-31
ATT&CK techniques
Resource Dev → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Bitbucket audit events where an "Unauthorized full data export triggered" action occurs under the "Data pipeline" category. Attempting full exports can indicate data theft or reconnaissance beyond normal user permissions. It relies on Bitbucket audit telemetry that records the audit type category and action for export attempts.
Reporting behind it
- confluence.atlassian.comhttps://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
- confluence.atlassian.comhttps://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
bitbucket-audit-unauthorized-full-data-export-triggered-34d81081
title: "Bitbucket Audit: Unauthorized Full Data Export Triggered (Data Pipeline)"
id: 9805128a-efa4-4a5f-8fed-7fef931b14dd
status: test
description: This rule flags Bitbucket audit events where an "Unauthorized full data export triggered" action occurs under the "Data pipeline" category. Attempting full exports can indicate data theft or reconnaissance beyond normal user permissions. It relies on Bitbucket audit telemetry that records the audit type category and action for export attempts.
references:
- https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
- https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-02-25
tags:
- attack.collection
- attack.resource-development
- attack.t1213.003
- attack.t1586
logsource:
product: bitbucket
service: audit
definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
selection:
auditType.category: Data pipeline
auditType.action: Unauthorized full data export triggered
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 34d81081-03c9-4a7f-91c9-5e46af625cde
type: derived