Bitbucket Full Data Export Triggered

Status: test
Severity: high
Log source: product bitbucket, service audit
Author: Muhammad Faisal (@faisalusuf)
Source: github.com/SigmaHQ/sigma

Detects when full data export is attempted.

Known false positives

Legitimate user activity.

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1213.003` Data from Information Repositories: Code Repositories

Rule body

title: Bitbucket Full Data Export Triggered
id: 195e1b9d-bfc2-4ffa-ab4e-35aef69815f8
status: test
description: Detects when full data export is attempted.
references:
    - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html
    - https://confluence.atlassian.com/adminjiraserver0811/importing-and-exporting-data-1019391889.html
author: Muhammad Faisal (@faisalusuf)
date: 2024-02-25
tags:
    - attack.collection
    - attack.t1213.003
logsource:
    product: bitbucket
    service: audit
    definition: 'Requirements: "Advance" log level is required to receive these audit events.'
detection:
    selection:
        auditType.category: 'Data pipeline'
        auditType.action: 'Full data export triggered'
    condition: selection
falsepositives:
    - Legitimate user activity.
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    auditType.category: 'Data pipeline'
    auditType.action: 'Full data export triggered'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`auditType.action`	eq	`Full data export triggered`	`field:"auditType.action" kind:eq value:"Full data export triggered"`
`auditType.category`	eq	`Data pipeline`	`field:"auditType.category" kind:eq value:"Data pipeline"`

Bitbucket Full Data Export Triggered

Known false positives

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`