Anthropic Organization Member and Group Enumeration

  1[metadata]
  2creation_date = "2026/09/16"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects a single user performing at least two distinct organization discovery actions within a 10-minute window: listing
 11users, exporting members, or viewing groups. Chaining these read actions maps membership and group structure and
 12commonly precedes targeted role grants, invites, or data collection against high-value accounts.
 13"""
 14false_positives = [
 15    """
 16    Organization administrators, identity teams, and compliance reviewers may list users, export members, and view
 17    groups during audits, access reviews, or offboarding. Confirm the actor and change ticket before escalating.
 18    """,
 19]
 20from = "now-11m"
 21interval = "10m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Organization Member and Group Enumeration"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Organization Member and Group Enumeration
 28
 29One email performed at least two distinct discovery actions among `org_users_listed`, `org_members_exported`, and
 30`group_list_viewed` in a short window — reconnaissance of who is in the tenant.
 31
 32Escalate when scripting UA, follow-on invites/role grants/SSO changes/exports appear, or the actor is not an identity
 33admin. Close as FP for scheduled access reviews or onboarding console browsing with a ticket.
 34
 35#### Possible investigation steps
 36
 37- Read `Esql.event_action_values` to see which discovery actions combined; all three in one window is stronger than
 38  two.
 39- Inspect IP/UA/actor type for automation or unfamiliar clients.
 40- Pivot the same actor/org for follow-on admin or project role grants, invites, SSO changes, or data exports.
 41- Note: some `org_members_exported` without user email (e.g. certain `anthropic_actor` cases) are out of scope.
 42
 43### False positive analysis
 44
 45- Membership exports during access reviews commonly combine two of these actions briefly.
 46
 47### Response and remediation
 48
 49- On unauthorized recon: revoke sessions, review recent role and invite changes, and tighten least privilege on
 50  identity read actions where possible.
 51"""
 52references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 53risk_score = 47
 54rule_id = "3fe56f6b-75c6-4ba1-88ff-e879145e0e1d"
 55severity = "medium"
 56tags = [
 57    "Domain: GenAI",
 58    "Platform: Anthropic",
 59    "Data Source: Anthropic Audit Logs",
 60    "Use Case: Threat Detection",
 61    "Use Case: UEBA",
 62    "Resources: Investigation Guide",
 63    "Rule Type: ES|QL",
 64    "Tactic: Discovery",
 65    "Mitre Atlas: AML.T0075",
 66]
 67timestamp_override = "event.ingested"
 68type = "esql"
 69
 70query = '''
 71from logs-anthropic.audit-*
 72| where
 73    data_stream.dataset == "anthropic.audit" and
 74    event.action in ("org_members_exported", "org_users_listed", "group_list_viewed") and
 75    user.email is not null
 76| stats
 77    Esql.event_action_count_distinct = count_distinct(event.action),
 78    Esql.event_action_values = values(event.action),
 79    Esql.event_count = count(*),
 80    Esql.event_id_values = values(event.id),
 81    Esql.source_ip_values = values(source.ip),
 82    Esql.user_agent_original_values = values(user_agent.original),
 83    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 84    Esql.user_id_values = values(user.id),
 85    Esql.timestamp_first_seen = min(@timestamp),
 86    Esql.timestamp_last_seen = max(@timestamp)
 87  by user.email, organization.id
 88| where Esql.event_action_count_distinct >= 2
 89| keep user.email, organization.id, Esql.*
 90'''
 91
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1069"
 97name = "Permission Groups Discovery"
 98reference = "https://attack.mitre.org/techniques/T1069/"
 99[[rule.threat.technique.subtechnique]]
100id = "T1069.003"
101name = "Cloud Groups"
102reference = "https://attack.mitre.org/techniques/T1069/003/"
103
104
105[[rule.threat.technique]]
106id = "T1087"
107name = "Account Discovery"
108reference = "https://attack.mitre.org/techniques/T1087/"
109[[rule.threat.technique.subtechnique]]
110id = "T1087.004"
111name = "Cloud Account"
112reference = "https://attack.mitre.org/techniques/T1087/004/"
113
114
115
116[rule.threat.tactic]
117id = "TA0007"
118name = "Discovery"
119reference = "https://attack.mitre.org/tactics/TA0007/"
120[[rule.threat_mappings]]
121framework = "MITRE ATLAS"
122version = "2026.08"
123[[rule.threat_mappings.threat]]
124framework = "MITRE ATLAS"
125[[rule.threat_mappings.threat.technique]]
126id = "AML.T0075"
127name = "Enterprise Resource Discovery"
128reference = "https://atlas.mitre.org/techniques/AML.T0075/"
129
130
131[rule.threat_mappings.threat.tactic]
132id = "AML.TA0008"
133name = "Discovery"
134reference = "https://atlas.mitre.org/tactics/AML.TA0008/"
135
136[rule.alert_suppression]
137group_by = ["user.email", "organization.id"]
138missing_fields_strategy = "suppress"
139
140[rule.investigation_fields]
141field_names = [
142    "user.email",
143    "organization.id",
144    "Esql.event_action_count_distinct",
145    "Esql.event_action_values",
146    "Esql.event_count",
147    "Esql.event_id_values",
148    "Esql.source_ip_values",
149    "Esql.user_agent_original_values",
150    "Esql.anthropic_audit_actor_type_values",
151    "Esql.user_id_values",
152    "Esql.timestamp_first_seen",
153    "Esql.timestamp_last_seen",
154]
155
156[rule.alert_suppression.duration]
157unit = "m"
158value = 10