Claude Cowork VM Boot Image Tamper

  1[metadata]
  2creation_date = "2026/08/05"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects unexpected modification of Claude Desktop Cowork VM boot images (kernel, initrd, root filesystem). Adversaries
 11with user-context access can rewrite these stored images so later Cowork sessions boot attacker-controlled code inside a
 12virtual instance that host EDR cannot inspect by default.
 13"""
 14from = "now-9m"
 15index = ["logs-endpoint.events.file-*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Claude Cowork VM Boot Image Tamper"
 19note = """## Triage and analysis
 20
 21### Investigating Claude Cowork VM Boot Image Tamper
 22
 23Cowork boots a local Linux VM from images under the user's Claude AppData / Application Support tree. Those files are
 24writable by the user and are not integrity-checked before boot. A non-Claude writer changing them is a strong signal of
 25post-compromise defense evasion: later Cowork sessions can run attacker code inside a sanctioned Hyper-V /
 26Virtualization.framework guest that host EDR does not see by default. This does not grant new privileges.
 27
 28### Possible investigation steps
 29
 30- Confirm the writer: `process.name`, `process.executable`, `process.parent.executable`, and `user.name`. This rule
 31  already excludes Claude Desktop (`claude.exe` under `WindowsApps\\Claude_*\\app\\`, and `Claude` /
 32  `Claude Helper` under `/Applications/Claude.app/`). Any other writer (script host, LOLBin, unsigned binary) is
 33  unexpected.
 34- Note which artifact changed (`file.name` / `file.path`) and `event.action`:
 35  - `initrd` / `initrd.zst`: primary PoC target; both are often replaced together so the service cannot re-extract a
 36    clean initrd from the `.zst`.
 37  - `vmlinuz` / `rootfs.*` / `smol-bin.vhdx`: full guest control if replaced.
 38- Pivot on `process.entity_id` / `host.id` for ~30m around the alert: how the writer started, other file writes under
 39  the Claude package path, and whether `claude.exe` / Claude.app then started a Cowork session.
 40- If Cowork runs afterward, check whether the session failed and Claude re-downloaded images (careless tamper) or
 41  continued normally (payload may have kept the expected guest daemon alive).
 42- Treat this as evidence of existing host compromise; hunt for the initial access that produced the writer process.
 43
 44### False positive analysis
 45
 46- Claude Desktop updates should not alert; if they do, the install path likely changed (new WindowsApps package layout
 47  or non-AppX install) and the allowlist needs updating, not an exception for the writer name alone.
 48- Backup or sync tools rewriting these exact filenames are uncommon; require a stable `process.executable` before
 49  adding an exception. This rule watches create/overwrite/rename/modification only; deletions are out of scope.
 50
 51### Response and remediation
 52
 53- Delete or restore the affected bundle directory (Windows:
 54  `%LOCALAPPDATA%\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\`; macOS:
 55  `~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/`) and let Claude re-download trusted images, or
 56  restore from a known-good backup.
 57- Isolate the host and investigate the writer process lineage; rotate credentials and secrets available to that user.
 58- Search the environment for the same writer hash/path and for other unexpected modifications under Claude package
 59  paths.
 60"""
 61references = ["https://y637f9qq2x.com/posts/cowork-boot-trust"]
 62risk_score = 47
 63rule_id = "a0939500-a817-4ce9-85a9-191133352a9e"
 64severity = "medium"
 65tags = [
 66    "Domain: Endpoint",
 67    "OS: macOS",
 68    "OS: Windows",
 69    "Use Case: Threat Detection",
 70    "Tactic: Defense Evasion",
 71    "Data Source: Elastic Defend",
 72    "Resources: Investigation Guide",
 73    "Rule Type: Event Correlation (EQL)",
 74    "Platform: Windows",
 75    "Platform: macOS",
 76    "Domain: GenAI",
 77    "Mitre Atlas: AML.T0097",
 78    "Mitre Atlas: AML.T0105",
 79]
 80timestamp_override = "event.ingested"
 81type = "eql"
 82
 83query = '''
 84file where host.os.type in ("windows", "macos") and
 85  event.action in ("creation", "modification", "overwrite", "rename") and
 86  event.outcome == "success" and
 87  file.path : (
 88    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd",
 89    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd.zst",
 90    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz",
 91    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz.zst",
 92    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img",
 93    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd",
 94    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd.zst",
 95    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\vmlinuz",
 96    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\rootfs.vhdx",
 97    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\smol-bin.vhdx"
 98  ) and
 99  not (
100    (process.name : "claude.exe" and
101     process.executable : "?:\\Program Files\\WindowsApps\\Claude_*\\app\\claude.exe") or
102    (process.name : ("Claude", "Claude Helper") and
103     process.executable like "/Applications/Claude.app/*")
104  )
105'''
106
107
108[[rule.threat]]
109framework = "MITRE ATT&CK"
110[[rule.threat.technique]]
111id = "T1564"
112name = "Hide Artifacts"
113reference = "https://attack.mitre.org/techniques/T1564/"
114[[rule.threat.technique.subtechnique]]
115id = "T1564.006"
116name = "Run Virtual Instance"
117reference = "https://attack.mitre.org/techniques/T1564/006/"
118
119
120
121[rule.threat.tactic]
122id = "TA0005"
123name = "Defense Evasion"
124reference = "https://attack.mitre.org/tactics/TA0005/"
125[[rule.threat_mappings]]
126framework = "MITRE ATLAS"
127version = "2026.08"
128[[rule.threat_mappings.threat]]
129framework = "MITRE ATLAS"
130[[rule.threat_mappings.threat.technique]]
131id = "AML.T0097"
132name = "Virtualization/Sandbox Evasion"
133reference = "https://atlas.mitre.org/techniques/AML.T0097/"
134
135
136[rule.threat_mappings.threat.tactic]
137id = "AML.TA0007"
138name = "Defense Evasion"
139reference = "https://atlas.mitre.org/tactics/AML.TA0007/"
140[[rule.threat_mappings.threat]]
141framework = "MITRE ATLAS"
142[[rule.threat_mappings.threat.technique]]
143id = "AML.T0105"
144name = "Escape to Host"
145reference = "https://atlas.mitre.org/techniques/AML.T0105/"
146
147
148[rule.threat_mappings.threat.tactic]
149id = "AML.TA0012"
150name = "Privilege Escalation"
151reference = "https://atlas.mitre.org/tactics/AML.TA0012/"