Detections target unauthorized access to Anthropic organization data exports. The rule monitors Anthropic audit logs for an event org_data_export_accessed within the anthropic.audit dataset, indicating that an export archive (containing chats, projects, user metadata, and configuration) was actually downloaded via a signed URL. It correlates this access with corresponding org_data_export_started and org_data_export_completed events for the same organization to distinguish legitimate activity from potential exfiltration. Unauthorized access is defined as: a download without a matching started event, or outside an approved hold/migration window, or export activity preceded by suspicious admin actions (granting admin rights, API key creation, logging changes, or SSO modifications) that could enable abuse. The rule is aligned with MITRE ATT&CK techniques T1530 (Data from Cloud Storage) and T1567 (Exfiltration Over Web Service), under the Collection and Exfiltration tactics. Investigation fields focus on actor identity, timestamps, and network/source data to enable rapid attribution and containment. The rule emphasizes triage steps (validate the actor, correlation with lifecycle events, and storage egress checks) and remediation (revoke admin access, contain the archive, and review related administrative changes). This enables detection of intellectual property or credential exfiltration at scale from organization exports via signed URLs.