This detection rule flags when an Anthropic audit log export archive is accessed, indicating that an actor downloaded exported audit activity. Attackers commonly pull audit exports to understand defender observation capabilities, identify gaps in detections, or erase or obfuscate evidence before making further control-plane changes. The rule maps to MITRE ATT&CK Collection (TA0009) with technique T1530 (Data from Cloud Storage) by observing a: audit_log_export_accessed event in Anthropic audit logs. Investigation should correlate with the corresponding audit_log_export_started to determine the export window and whether admin activity aligns with approved tasks. The rule’s investigation fields (e.g., anthropic.audit.from_date, anthropic.audit.to_date, actor details, and user_agent) help reconstruct the activity and verify timing relative to IAM/logging changes. Triage and analysis guidance includes: - Check anthropic.audit.from_date/to_date to identify exactly which admin actions were pulled and verify actor identity (email/IP/UA) against known IR/compliance personnel. - Look for a preceding audit_log_export_started event and assess whether the export window overlaps with recent IAM or logging changes that the actor subsequently altered. - Evaluate patterns such as a download followed by logging disablement or SSO changes as common recon-then-abuse sequences. False positives may occur when legitimate security/compliance tasks involve export requests. Validate the actor against an approved ticket and confirm the activity aligns with regulatory or investigative work. Response and remediation steps include: - If unauthorized: revoke actor access, determine whether export data left the organization, and assess whether compliance logging or related controls were modified around the same time. - Ensure that export activity is properly ticketed and reviewed, and consider enhancing monitoring around export-enabled roles and elevated permissions. Overall, this rule supports detecting potential misuse of audit data during post-compromise recon or initial phases of a control-plane manipulation, enabling rapid containment and investigation.