LoFP / compliance, legal, and platform teams download organization data exports after scheduled audits, migrations, or litigation holds. validate the actor and business justification before escalating.

Techniques

• T1530
• T1567

Sample rules

Anthropic Organization Data Export Accessed

• source: elastic
• technicques:
  • T1530
  • T1567

Description

Starting an organization data export only signals intent. Accessing the export archive via its signed URL means the actor actually downloaded chats, projects, user metadata, and configuration. An attacker with administrative access can use this to exfiltrate intellectual property and credentials at scale.

Detection logic

from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "file") and
    event.action == "org_data_export_accessed"
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*