Anthropic Magic Link Second Factor Disabled

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Magic link second factor adds an extra authentication step to passwordless sign-in for Anthropic. An attacker with
 11administrative access can turn it off so magic link logins no longer require the second factor, which makes stolen or
 12attacker-controlled mailboxes usable for interactive access. This often shows up alongside SSO weakening when the
 13attacker wants a fallback authentication path outside the corporate IdP.
 14"""
 15false_positives = [
 16    """
 17    Administrators disable magic link second factor during authentication policy changes or troubleshooting. Verify
 18    the actor and whether the setting was re-enabled or replaced with an equivalent control.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Magic Link Second Factor Disabled"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Magic Link Second Factor Disabled
 28
 29Magic link second factor is an extra step on passwordless sign-in. Disabling it means anyone who can receive the
 30mailbox's magic link can authenticate without that second check — a useful fallback if an attacker also weakens SSO.
 31
 32Treat as unauthorized unless identity has a change ticket / maintenance window that names this control, or the setting
 33was re-enabled (or replaced with equivalent MFA) within the same change window.
 34
 35#### Possible investigation steps
 36
 37- Identify the actor (`anthropic.audit.actor.type`). For `user_actor`, check whether `user.email`, `source.ip`, and
 38  `user_agent.original` match a known admin; a scripting UA or unfamiliar IP raises priority.
 39- In the same `organization.id` and ±hours window, look for SSO disable/deactivate/delete, admin role grants, or a
 40  burst of `magic_link_login_succeeded` after the change.
 41- Close as FP when the ticket matches the actor and time, and second factor (or equivalent IdP MFA) was restored.
 42  Escalate when there is no ticket, the actor is unexpected, or sibling auth-weakening events appear.
 43
 44### False positive analysis
 45
 46- Auth migrations and troubleshooting sometimes disable this briefly; require a ticket and restoration evidence.
 47
 48### Response and remediation
 49
 50- On unauthorized disable: re-enable magic link second factor, review magic-link sign-ins since the change, and
 51  investigate concurrent SSO / admin IAM events for the same organization.
 52"""
 53references = [
 54    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 55]
 56risk_score = 73
 57rule_id = "58ad16ae-4c96-424e-9cd2-c151ac79e8ea"
 58severity = "high"
 59tags = [
 60    "Domain: GenAI",
 61    "Domain: Identity",
 62    "Platform: Anthropic",
 63    "Data Source: Anthropic Audit Logs",
 64    "Use Case: Identity and Access Audit",
 65    "Use Case: Threat Detection",
 66    "Resources: Investigation Guide",
 67    "Rule Type: ES|QL",
 68    "Tactic: Defense Evasion",
 69]
 70timestamp_override = "event.ingested"
 71type = "esql"
 72
 73query = '''
 74from logs-anthropic.audit-* metadata _id, _version, _index
 75| where
 76    data_stream.dataset == "anthropic.audit" and
 77    mv_contains(event.category, "configuration") and
 78    event.action == "org_magic_link_second_factor_toggled" and
 79    anthropic.audit.enabled == false
 80| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 81'''
 82
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86[[rule.threat.technique]]
 87id = "T1556"
 88name = "Modify Authentication Process"
 89reference = "https://attack.mitre.org/techniques/T1556/"
 90[[rule.threat.technique.subtechnique]]
 91id = "T1556.006"
 92name = "Multi-Factor Authentication"
 93reference = "https://attack.mitre.org/techniques/T1556/006/"
 94
 95
 96
 97[rule.threat.tactic]
 98id = "TA0005"
 99name = "Defense Evasion"
100reference = "https://attack.mitre.org/tactics/TA0005/"
101
102[rule.investigation_fields]
103field_names = [
104    "@timestamp",
105    "event.action",
106    "event.id",
107    "organization.id",
108    "anthropic.audit.enabled",
109    "anthropic.audit.actor.type",
110    "user.email",
111    "user.id",
112    "source.ip",
113    "user_agent.original",
114]