Anthropic User Activity From High Number of Countries

  1[metadata]
  2creation_date = "2026/10/05"
  3integration = ["anthropic"]
  4maturity = "production"
  5min_stack_comments = "ES|QL IP_LOCATION requires 9.5.0+."
  6min_stack_version = "9.5.0"
  7updated_date = "2026/10/05"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects Anthropic activity for the same user email from at least three countries and two unique user agents within a four-hour interval.
 13This highly unusual activity may indicate leaked session cookies being abused by a remote adversary using a VPN.
 14"""
 15false_positives = [
 16    """
 17    Users on VPN or proxy egress that geo-resolves through a region distant from the user's physical location. Mobile
 18    clients on cellular networks that peer through regional hubs may geo-resolve differently than the user's location.
 19    """,
 20    """
 21    Cloud egress, split-tunnel, or dual-homed clients that present different public IPs for concurrent Anthropic
 22    sessions (for example browser and API tooling) can look like impossible travel when both resolve far apart.
 23    """,
 24]
 25from = "now-4h"
 26interval = "5m"
 27language = "esql"
 28license = "Elastic License v2"
 29name = "Anthropic User Activity From High Number of Countries"
 30note = """## Triage and analysis
 31
 32### Investigating Anthropic User Activity From High Number of Countries
 33
 34Successful `user_actor` activity for the same email spans distant countries too quickly for travel. 
 35
 36Escalate when countries differ, UAs diverge (browser vs curl/python), login events are absent, or admin/export
 37actions appear on the distant IP. Close as FP for documented dual-homed VPN/cloud egress with consistent corporate
 38UAs.
 39
 40#### Possible investigation steps
 41
 42- Use `Esql.source_geo_country_name_values` to verify the user's activity history by country.
 43- Use `Esql.event_action_values` to verify the performed actions.
 44- Contact the user to verify if he is using VPN.
 45- Check for nearby logins. Absence + privileged distant actions → treat as cookie replay until proven otherwise.
 46
 47### False positive analysis
 48
 49- Split-tunnel / dual-homed clients (browser + API tooling) and VPN geo noise are the main FPs — require ASN/UA
 50  corroboration.
 51
 52### Response and remediation
 53
 54- On suspected replay/compromise: force logout for the target user from all connected devices, revoke sessions, reset
 55  credentials/MFA, hunt concurrent sessions, and review compliance/export and role changes for the same `user.email`
 56  after the distant events.
 57"""
 58references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 59risk_score = 99
 60rule_id = "6a9de6a3-fc25-4e94-a735-dd147ffb0067"
 61severity = "critical"
 62tags = [
 63    "Domain: GenAI",
 64    "Domain: Identity",
 65    "Platform: Anthropic",
 66    "Data Source: Anthropic Audit Logs",
 67    "Use Case: Identity and Access Audit",
 68    "Use Case: Threat Detection",
 69    "Resources: Investigation Guide",
 70    "Rule Type: ES|QL",
 71    "Tactic: Credential Access",
 72    "Tactic: Initial Access",
 73    "Mitre Atlas: AML.T0012",
 74    "Threat: Impossible Travel"
 75]
 76timestamp_override = "event.ingested"
 77type = "esql"
 78
 79query = '''
 80FROM logs-anthropic.audit-* 
 81| where user.email IS NOT NULL and source.ip IS NOT NULL and  `user.email` != "unknown@invalid.internal"
 82| IP_LOCATION geo = source.ip with { "properties": ["country_name", "city_name", "location"] }
 83| stats Esql.country_count = COUNT_DISTINCT(geo.country_name), 
 84        Esql.source_ip_count = COUNT_DISTINCT(source.ip), 
 85        Esql.user_agent_count = COUNT_DISTINCT(`user_agent`.original),
 86        Esql.event_count = count(*),
 87        Esql.event_action_values = values(event.action), 
 88        Esql.source_ip_values = values(source.ip), 
 89        Esql.source_geo_country_name_values = values(geo.country_name), 
 90        Esql.source_geo_city_name_values = values(geo.city_name), 
 91        Esql.user_agent_original_values = values(user_agent.original), 
 92        Esql.timestamp_first_seen = min(@timestamp), 
 93        Esql.timestamp_last_seen = max(@timestamp) by user.email 
 94| where Esql.country_count >= 3 AND Esql.user_agent_count >= 2 AND 
 95  (MV_CONTAINS(Esql.event_action_values, "claude_chat_created") or MV_CONTAINS(Esql.event_action_values, "claude_chat_deleted") or MV_CONTAINS(Esql.event_action_values, "claude_user_settings_updated") or MV_CONTAINS(Esql.event_action_values, "claude_file_deleted") or MV_CONTAINS(Esql.event_action_values, "claude_chat_updated")) 
 96| Keep user.email, Esql.*
 97'''
 98
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102[[rule.threat.technique]]
103id = "T1539"
104name = "Steal Web Session Cookie"
105reference = "https://attack.mitre.org/techniques/T1539/"
106
107
108[rule.threat.tactic]
109id = "TA0006"
110name = "Credential Access"
111reference = "https://attack.mitre.org/tactics/TA0006/"
112[[rule.threat]]
113framework = "MITRE ATT&CK"
114[[rule.threat.technique]]
115id = "T1078"
116name = "Valid Accounts"
117reference = "https://attack.mitre.org/techniques/T1078/"
118[[rule.threat.technique.subtechnique]]
119id = "T1078.004"
120name = "Cloud Accounts"
121reference = "https://attack.mitre.org/techniques/T1078/004/"
122
123
124
125[rule.threat.tactic]
126id = "TA0001"
127name = "Initial Access"
128reference = "https://attack.mitre.org/tactics/TA0001/"
129[[rule.threat_mappings]]
130framework = "MITRE ATLAS"
131version = "2026.08"
132[[rule.threat_mappings.threat]]
133framework = "MITRE ATLAS"
134[[rule.threat_mappings.threat.technique]]
135id = "AML.T0012"
136name = "Valid Accounts"
137reference = "https://atlas.mitre.org/techniques/AML.T0012/"
138
139
140[rule.threat_mappings.threat.tactic]
141id = "AML.TA0004"
142name = "Initial Access"
143reference = "https://atlas.mitre.org/tactics/AML.TA0004/"
144
145
146[rule.investigation_fields]
147field_names = [
148    "user.email",
149    "Esql.country_count",
150    "Esql.event_count",
151    "Esql.event_action_values",
152    "Esql.source_ip_values",
153    "Esql.source_geo_country_name_values",
154    "Esql.source_geo_city_name_values",
155    "Esql.user_agent_original_values",
156    "Esql.timestamp_first_seen",
157    "Esql.timestamp_last_seen",
158]
159
160[rule.alert_suppression]
161group_by = ["user.email"]
162missing_fields_strategy = "suppress"
163
164[rule.alert_suppression.duration]
165unit = "h"
166value = 4