Anthropic Artifact Shared Publicly

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5min_stack_comments = "FIELD_EXTRACT for flattened fields requires 9.5.0"
  6min_stack_version = "9.5.0"
  7updated_date = "2026/09/21"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Claude artifacts can be shared with specific audiences. Making an artifact public exposes its contents to
 13unauthenticated viewers on the internet. An attacker with access to sensitive artifacts can publish them publicly to
 14push intellectual property, credentials embedded in prompts, or other confidential material outside organizational
 15controls.
 16"""
 17false_positives = [
 18    """
 19    Users publish artifacts intentionally for demos, documentation, or external collaboration. Validate the artifact,
 20    actor, and business justification before escalating.
 21    """,
 22]
 23from = "now-9m"
 24language = "esql"
 25license = "Elastic License v2"
 26name = "Anthropic Artifact Shared Publicly"
 27note = """## Triage and analysis
 28
 29### Investigating Anthropic Artifact Shared Publicly
 30
 31A Claude artifact's sharing audience includes `anyone_with_link` (open internet). Each sharing change is its own
 32alert/artifact ID.
 33
 34Unauthorized = no marketing/training justification, artifact holds credentials/customer/proprietary content, or the
 35same actor recently had chat access failures / data exports. Close as FP for intentional external demos with
 36non-sensitive content.
 37
 38#### Possible investigation steps
 39
 40- Verify audience includes `anyone_with_link` via flattened `audience` (`FIELD_EXTRACT` + `mv_contains` or
 41  `event.original`) and note `anthropic.audit.claude_artifact_id`.
 42- Validate actor (email/IP/UA). Inspect artifact content for secrets or proprietary data when accessible.
 43- Look for related chat access failures or data exports from the same actor in the same window.
 44
 45### False positive analysis
 46
 47- DevRel/training publishes are FP when the artifact is non-sensitive and a marketing/training request exists.
 48
 49### Response and remediation
 50
 51- On unauthorized publication: revoke public sharing, inventory other artifacts modified by the same actor, and
 52  treat any embedded secrets as compromised.
 53"""
 54references = [
 55    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 56]
 57risk_score = 47
 58rule_id = "14290b38-a8dd-474d-bfd7-cce282f4f745"
 59severity = "medium"
 60tags = [
 61    "Domain: GenAI",
 62    "Platform: Anthropic",
 63    "Data Source: Anthropic Audit Logs",
 64    "Use Case: Threat Detection",
 65    "Resources: Investigation Guide",
 66    "Rule Type: ES|QL",
 67    "Tactic: Exfiltration",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71
 72query = '''
 73from logs-anthropic.audit-* metadata _id, _version, _index
 74| where
 75    data_stream.dataset == "anthropic.audit" and
 76    mv_contains(event.category, "configuration") and
 77    event.action == "claude_artifact_sharing_updated"
 78| eval Esql.audience_types = FIELD_EXTRACT(anthropic.audit.audience, "type")
 79| where Esql.audience_types is not null and mv_contains(Esql.audience_types, "anyone_with_link")
 80| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*, Esql.audience_types
 81'''
 82
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86[[rule.threat.technique]]
 87id = "T1567"
 88name = "Exfiltration Over Web Service"
 89reference = "https://attack.mitre.org/techniques/T1567/"
 90
 91
 92[rule.threat.tactic]
 93id = "TA0010"
 94name = "Exfiltration"
 95reference = "https://attack.mitre.org/tactics/TA0010/"
 96
 97[rule.investigation_fields]
 98field_names = [
 99    "@timestamp",
100    "event.action",
101    "event.id",
102    "organization.id",
103    "anthropic.audit.claude_artifact_id",
104    "anthropic.audit.audience",
105    "anthropic.audit.actor.type",
106    "user.email",
107    "user.id",
108    "source.ip",
109    "user_agent.original",
110]