Claude Cowork VM Boot Image Tamper

  1[metadata]
  2creation_date = "2026/08/05"
  3integration = ["endpoint"]
  4maturity = "production"
  5updated_date = "2026/08/06"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects unexpected modification of Claude Desktop Cowork VM boot images (kernel, initrd, root filesystem). Adversaries
 11with user-context access can rewrite these stored images so later Cowork sessions boot attacker-controlled code inside a
 12virtual instance that host EDR cannot inspect by default.
 13"""
 14from = "now-9m"
 15index = ["logs-endpoint.events.file-*"]
 16language = "eql"
 17license = "Elastic License v2"
 18name = "Claude Cowork VM Boot Image Tamper"
 19note = """## Triage and analysis
 20
 21### Investigating Claude Cowork VM Boot Image Tamper
 22
 23Cowork boots a local Linux VM from images under the user's Claude AppData / Application Support tree. Those files are
 24writable by the user and are not integrity-checked before boot. A non-Claude writer changing them is a strong signal of
 25post-compromise defense evasion: later Cowork sessions can run attacker code inside a sanctioned Hyper-V /
 26Virtualization.framework guest that host EDR does not see by default. This does not grant new privileges.
 27
 28### Possible investigation steps
 29
 30- Confirm the writer: `process.name`, `process.executable`, `process.parent.executable`, and `user.name`. This rule
 31  already excludes Claude Desktop (`claude.exe` under `WindowsApps\\Claude_*\\app\\`, and `Claude` /
 32  `Claude Helper` under `/Applications/Claude.app/`). Any other writer (script host, LOLBin, unsigned binary) is
 33  unexpected.
 34- Note which artifact changed (`file.name` / `file.path`) and `event.action`:
 35  - `initrd` / `initrd.zst`: primary PoC target; both are often replaced together so the service cannot re-extract a
 36    clean initrd from the `.zst`.
 37  - `vmlinuz` / `rootfs.*` / `smol-bin.vhdx`: full guest control if replaced.
 38- Pivot on `process.entity_id` / `host.id` for ~30m around the alert: how the writer started, other file writes under
 39  the Claude package path, and whether `claude.exe` / Claude.app then started a Cowork session.
 40- If Cowork runs afterward, check whether the session failed and Claude re-downloaded images (careless tamper) or
 41  continued normally (payload may have kept the expected guest daemon alive).
 42- Treat this as evidence of existing host compromise; hunt for the initial access that produced the writer process.
 43
 44### False positive analysis
 45
 46- Claude Desktop updates should not alert; if they do, the install path likely changed (new WindowsApps package layout
 47  or non-AppX install) and the allowlist needs updating, not an exception for the writer name alone.
 48- Backup or sync tools rewriting these exact filenames are uncommon; require a stable `process.executable` before
 49  adding an exception. This rule watches create/overwrite/rename/modification only; deletions are out of scope.
 50
 51### Response and remediation
 52
 53- Delete or restore the affected bundle directory (Windows:
 54  `%LOCALAPPDATA%\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\`; macOS:
 55  `~/Library/Application Support/Claude/vm_bundles/claudevm.bundle/`) and let Claude re-download trusted images, or
 56  restore from a known-good backup.
 57- Isolate the host and investigate the writer process lineage; rotate credentials and secrets available to that user.
 58- Search the environment for the same writer hash/path and for other unexpected modifications under Claude package
 59  paths.
 60"""
 61references = ["https://y637f9qq2x.com/posts/cowork-boot-trust"]
 62risk_score = 47
 63rule_id = "a0939500-a817-4ce9-85a9-191133352a9e"
 64severity = "medium"
 65tags = [
 66    "Domain: Endpoint",
 67    "OS: macOS",
 68    "OS: Windows",
 69    "Use Case: Threat Detection",
 70    "Tactic: Defense Evasion",
 71    "Data Source: Elastic Defend",
 72    "Resources: Investigation Guide",
 73    "Domain: LLM",
 74]
 75timestamp_override = "event.ingested"
 76type = "eql"
 77
 78query = '''
 79file where host.os.type in ("windows", "macos") and
 80  event.action in ("creation", "modification", "overwrite", "rename") and
 81  event.outcome == "success" and
 82  file.path : (
 83    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd",
 84    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd.zst",
 85    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz",
 86    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz.zst",
 87    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img",
 88    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd",
 89    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd.zst",
 90    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\vmlinuz",
 91    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\rootfs.vhdx",
 92    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\smol-bin.vhdx"
 93  ) and
 94  not (
 95    (process.name : "claude.exe" and
 96     process.executable : "?:\\Program Files\\WindowsApps\\Claude_*\\app\\claude.exe") or
 97    (process.name : ("Claude", "Claude Helper") and
 98     process.executable like "/Applications/Claude.app/*")
 99  )
100'''
101
102
103[[rule.threat]]
104framework = "MITRE ATT&CK"
105[[rule.threat.technique]]
106id = "T1564"
107name = "Hide Artifacts"
108reference = "https://attack.mitre.org/techniques/T1564/"
109[[rule.threat.technique.subtechnique]]
110id = "T1564.006"
111name = "Run Virtual Instance"
112reference = "https://attack.mitre.org/techniques/T1564/006/"
113
114
115
116[rule.threat.tactic]
117id = "TA0005"
118name = "Defense Evasion"
119reference = "https://attack.mitre.org/tactics/TA0005/"