Anthropic Activity from a Suspicious User Agent

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful Anthropic audit activity where the user agent matches scripting HTTP clients, offensive scanners,
 11or automation libraries (for example curl, python-requests, Go-http-client, axios, nuclei). Browser and first-party
 12Claude clients normally present recognizable browser or product user agents; raw HTTP library agents on successful
 13control-plane or product activity often indicate scripted access, stolen-session reuse, or unauthorized automation.
 14Known benign automation patterns (axios or Go HTTP clients on file upload/delete, trusted device enrollment, and
 15environment creation) are excluded.
 16"""
 17false_positives = [
 18    """
 19    Approved internal automation, CI jobs, or SDK integrations may present scripting user agents. Validate the actor,
 20    source IP, and action against change tickets before treating as compromise. Prefer excluding stable identities or
 21    source networks rather than removing the matching user-agent pattern.
 22    """,
 23    """
 24    Penetration tests and red-team exercises that use curl, httpx, or similar clients will match. Add temporary
 25    exceptions for the engagement window after validation.
 26    """,
 27]
 28from = "now-9m"
 29language = "esql"
 30license = "Elastic License v2"
 31name = "Anthropic Activity from a Suspicious User Agent"
 32note = """## Triage and analysis
 33
 34### Investigating Anthropic Activity from a Suspicious User Agent
 35
 36Successful Anthropic audit events normally come from browser or first-party Claude clients. This rule flags scripting
 37HTTP clients, scanners, or automation libraries on successful activity. UAs are spoofable — corroborate with actor,
 38IP, and `event.action`.
 39
 40Benign automation using axios or Go HTTP clients is already excluded for `platform_file_uploaded`,
 41`platform_file_deleted`, `claude_file_uploaded`, `trusted_device_enrolled`, and `environment_created`.
 42
 43Unauthorized / escalate when a normally browser-bound user suddenly uses curl/python/Go-http-client on privileged
 44actions (IAM, exports, SSO, keys). Close as FP for approved SDK/CI identities on expected actions.
 45
 46#### Possible investigation steps
 47
 48- Compare `user_agent.original` and `event.action` to the user's baseline. A shift to curl, python-requests, or
 49  Go-http-client on admin/export actions is higher priority than the same UA on already-allowlisted file ops.
 50- Branch `anthropic.audit.actor.type` and check `user.email` / `source.ip` against approved automation inventory.
 51- Pivot the same email/IP for auth failures, impossible travel, role changes, exports, or compliance logging changes.
 52
 53### False positive analysis
 54
 55- Internal GenAI SDKs (`openai*`, `anthropic-sdk*`, `langchain*`) and CI jobs match — exclude stable identities, not
 56  entire UA families. Extend the Go/axios action allowlist only with evidence of additional benign actions.
 57
 58### Response and remediation
 59
 60- On unauthorized scripting access: revoke sessions, rotate credentials/MFA, review admin/export activity around the
 61  alert, and hunt other scripting-UA activity from the same IP or email.
 62"""
 63references = [
 64    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 65]
 66risk_score = 47
 67rule_id = "d370aacb-a344-4578-a69c-beca88e063a1"
 68severity = "medium"
 69tags = [
 70    "Domain: GenAI",
 71    "Platform: Anthropic",
 72    "Data Source: Anthropic Audit Logs",
 73    "Use Case: Threat Detection",
 74    "Resources: Investigation Guide",
 75    "Rule Type: ES|QL",
 76    "Tactic: Command and Control",
 77]
 78timestamp_override = "event.ingested"
 79type = "esql"
 80
 81query = '''
 82from logs-anthropic.audit-* metadata _id, _version, _index
 83| where
 84    data_stream.dataset == "anthropic.audit" and
 85    event.outcome == "success" and
 86    source.ip is not null and
 87    source.ip != "0.0.0.0" and
 88    user.email is not null and
 89    user_agent.original is not null
 90| eval Esql.ua_lower = to_lower(user_agent.original)
 91| where
 92    (
 93        Esql.ua_lower like "curl*" or
 94        Esql.ua_lower like "python*" or
 95        Esql.ua_lower like "wget*" or
 96        Esql.ua_lower like "go-http*" or
 97        Esql.ua_lower like "perl*" or
 98        Esql.ua_lower like "libwww-perl*" or
 99        Esql.ua_lower like "java*" or
100        Esql.ua_lower like "node*" or
101        Esql.ua_lower like "php*" or
102        Esql.ua_lower like "guzzle*" or
103        Esql.ua_lower like "bun*" or
104        Esql.ua_lower like "axios*" or
105        Esql.ua_lower like "undici*" or
106        Esql.ua_lower like "okhttp*" or
107        Esql.ua_lower like "apache-httpclient*" or
108        Esql.ua_lower like "httpclient*" or
109        Esql.ua_lower like "httpie*" or
110        Esql.ua_lower like "ruby*" or
111        Esql.ua_lower like "postmanruntime*" or
112        Esql.ua_lower like "restsharp*" or
113        Esql.ua_lower like "*kali*" or
114        Esql.ua_lower like "*parrot*" or
115        Esql.ua_lower like "*pentoo*" or
116        Esql.ua_lower like "*backbox*" or
117        Esql.ua_lower like "*blackarch*" or
118        Esql.ua_lower like "scrapy*" or
119        Esql.ua_lower like "mechanize*" or
120        Esql.ua_lower like "aiohttp*" or
121        Esql.ua_lower like "httpx*" or
122        Esql.ua_lower like "requests*" or
123        Esql.ua_lower like "pycurl*" or
124        Esql.ua_lower like "urllib*" or
125        Esql.ua_lower like "got/*" or
126        Esql.ua_lower like "node-fetch*" or
127        Esql.ua_lower like "superagent*" or
128        Esql.ua_lower like "ky/*" or
129        Esql.ua_lower like "fetch*" or
130        Esql.ua_lower like "deno*" or
131        Esql.ua_lower like "powershell*" or
132        Esql.ua_lower like "invoke-webrequest*" or
133        Esql.ua_lower like "windowspowershell*" or
134        Esql.ua_lower like "wget2*" or
135        Esql.ua_lower like "aria2*" or
136        Esql.ua_lower like "httrack*" or
137        Esql.ua_lower like "nikto*" or
138        Esql.ua_lower like "sqlmap*" or
139        Esql.ua_lower like "nmap*" or
140        Esql.ua_lower like "masscan*" or
141        Esql.ua_lower like "zgrab*" or
142        Esql.ua_lower like "nuclei*" or
143        Esql.ua_lower like "dirbuster*" or
144        Esql.ua_lower like "gobuster*" or
145        Esql.ua_lower like "ffuf*" or
146        Esql.ua_lower like "feroxbuster*" or
147        Esql.ua_lower like "wfuzz*" or
148        Esql.ua_lower like "burpsuite*" or
149        Esql.ua_lower like "hydra*" or
150        Esql.ua_lower like "metasploit*" or
151        Esql.ua_lower like "*havoc*" or
152        Esql.ua_lower like "*sliver*" or
153        Esql.ua_lower like "*cobalt strike*" or
154        Esql.ua_lower like "dart*" or
155        Esql.ua_lower like "rector*" or
156        Esql.ua_lower like "ruby-faraday*" or
157        Esql.ua_lower like "httparty*" or
158        Esql.ua_lower like "clj-http*" or
159        Esql.ua_lower like "hackney*" or
160        Esql.ua_lower like "elixir*" or
161        Esql.ua_lower like "swift-nio*" or
162        Esql.ua_lower like "vapor*" or
163        Esql.ua_lower like "rust*" or
164        Esql.ua_lower like "reqwest*" or
165        Esql.ua_lower like "ureq*" or
166        Esql.ua_lower like "hyper/*" or
167        Esql.ua_lower like "cohere-go*" or
168        Esql.ua_lower like "openai*" or
169        Esql.ua_lower like "anthropic-sdk*" or
170        Esql.ua_lower like "langchain*" or
171        Esql.ua_lower like "llamaindex*" or
172        Esql.ua_lower like "litellm*" or
173        Esql.ua_lower like "dspy*" or
174        Esql.ua_lower like "*zgrab*" or
175        Esql.ua_lower like "*masscan*" or
176        Esql.ua_lower like "*nessus*" or
177        Esql.ua_lower like "*shodan*" or
178        Esql.ua_lower like "*censys*" or
179        Esql.ua_lower like "*binaryedge*" or
180        Esql.ua_lower like "*internetmeasurement*" or
181        Esql.ua_lower like "*internetcensus*" or
182        Esql.ua_lower like "*shadowserver*" or
183        Esql.ua_lower like "*stretchoid*" or
184        Esql.ua_lower like "*http.rb*"
185    ) and
186    not (
187        event.action in (
188            "platform_file_deleted",
189            "platform_file_uploaded",
190            "claude_file_uploaded",
191            "trusted_device_enrolled",
192            "environment_created"
193        ) and
194        (Esql.ua_lower like "go-http*" or Esql.ua_lower like "axios*")
195    )
196| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*, Esql.ua_lower
197'''
198
199
200[[rule.threat]]
201framework = "MITRE ATT&CK"
202[[rule.threat.technique]]
203id = "T1071"
204name = "Application Layer Protocol"
205reference = "https://attack.mitre.org/techniques/T1071/"
206[[rule.threat.technique.subtechnique]]
207id = "T1071.001"
208name = "Web Protocols"
209reference = "https://attack.mitre.org/techniques/T1071/001/"
210
211
212[rule.threat.tactic]
213id = "TA0011"
214name = "Command and Control"
215reference = "https://attack.mitre.org/tactics/TA0011/"
216
217[rule.alert_suppression]
218group_by = ["user.email", "source.ip", "user_agent.original"]
219duration = {value = 1, unit = "h"}
220missing_fields_strategy = "suppress"
221
222[rule.investigation_fields]
223field_names = [
224    "@timestamp",
225    "event.action",
226    "event.id",
227    "event.outcome",
228    "organization.id",
229    "user.email",
230    "user.id",
231    "source.ip",
232    "user_agent.original",
233    "anthropic.audit.actor.type",
234    "Esql.ua_lower",
235]