Anthropic High File Upload Activity

  1[metadata]
  2creation_date = "2026/09/15"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an unusually high volume of Claude file uploads from the same user email and source IP within a rolling
 1124-hour period. Sustained upload activity can indicate staging of sensitive documents in Claude chats for later
 12retrieval, automated ingestion of data into LLM workflows, or abuse of organizational Claude access to move files into
 13the cloud service.
 14"""
 15false_positives = [
 16    """
 17    Developers, analysts, or knowledge workers bulk-uploading documents during migrations, evaluations, or large project
 18    onboarding can exceed the daily threshold from a single workstation or VPN egress.
 19    """,
 20]
 21from = "now-24h"
 22interval = "1h"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "Anthropic High File Upload Activity"
 26note = """## Triage and analysis
 27
 28### Investigating Anthropic High File Upload Activity
 29
 30One `user.email` + `source.ip` pair uploaded a large volume of Claude files in 24 hours — possible staging for later
 31retrieval, automated ingestion, or abuse of org Claude access.
 32
 33Unauthorized / escalate when filenames look sensitive, uploads target shared/sensitive projects, UA looks automated
 34(curl/python vs browser), or artifact sharing / exports follow. Close as FP for documented migrations, RAG pilots, or
 35batch attach jobs with expected project IDs.
 36
 37#### Possible investigation steps
 38
 39- Start with `Esql.event_count`, `Esql.file_name_values`, and chat/project ID lists — sensitive names or shared
 40  project IDs raise priority.
 41- Triage `user_agent` on raw uploads: browser-like vs scripting clients. Scripting UAs with many distinct file IDs
 42  look more like automation than interactive work.
 43- Pivot raw `logs-anthropic.audit-*` for individual `anthropic.audit.claude_file_id` / filenames and whether
 44  `claude_file_viewed` or chat activity matches the upload volume.
 45- Correlate with artifact sharing, data exports, or compliance key creation from the same user.
 46
 47### False positive analysis
 48
 49- Document migrations and RAG indexing from one seat commonly exceed the threshold.
 50
 51### Response and remediation
 52
 53- On unauthorized staging: revoke sessions, review uploaded names/file IDs for sensitive content, and tighten project
 54  sharing or upload policy for the actor.
 55"""
 56references = [
 57    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 58]
 59risk_score = 47
 60rule_id = "58295a79-5dde-4fc9-a967-2dbe39fb8bc7"
 61severity = "medium"
 62tags = [
 63    "Domain: GenAI",
 64    "Platform: Anthropic",
 65    "Data Source: Anthropic Audit Logs",
 66    "Use Case: Threat Detection",
 67    "Use Case: UEBA",
 68    "Resources: Investigation Guide",
 69    "Rule Type: ES|QL",
 70    "Tactic: Exfiltration",
 71]
 72timestamp_override = "event.ingested"
 73type = "esql"
 74
 75query = '''
 76from logs-anthropic.audit-*
 77| where
 78    data_stream.dataset == "anthropic.audit" and
 79    event.action == "claude_file_uploaded" and
 80    event.outcome == "success" and
 81    user.email is not null and
 82    source.ip is not null
 83| stats
 84    Esql.event_count = count(*),
 85    Esql.event_id_values = values(event.id),
 86    Esql.file_name_values = values(file.name),
 87    Esql.anthropic_audit_claude_file_id_values = values(anthropic.audit.claude_file_id),
 88    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
 89    Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id),
 90    Esql.user_agent_original_values = values(user_agent.original),
 91    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 92    Esql.timestamp_first_seen = min(@timestamp),
 93    Esql.timestamp_last_seen = max(@timestamp)
 94  by user.email, source.ip
 95| where Esql.event_count >= 100
 96| keep user.email, source.ip, Esql.*
 97'''
 98
 99
100[[rule.threat]]
101framework = "MITRE ATT&CK"
102[[rule.threat.technique]]
103id = "T1567"
104name = "Exfiltration Over Web Service"
105reference = "https://attack.mitre.org/techniques/T1567/"
106
107
108[rule.threat.tactic]
109id = "TA0010"
110name = "Exfiltration"
111reference = "https://attack.mitre.org/tactics/TA0010/"
112
113[rule.alert_suppression]
114group_by = ["user.email", "source.ip"]
115duration = {value = 24, unit = "h"}
116missing_fields_strategy = "suppress"
117
118[rule.investigation_fields]
119field_names = [
120    "user.email",
121    "source.ip",
122    "Esql.event_count",
123    "Esql.event_id_values",
124    "Esql.file_name_values",
125    "Esql.anthropic_audit_claude_file_id_values",
126    "Esql.anthropic_audit_claude_chat_id_values",
127    "Esql.anthropic_audit_claude_project_id_values",
128    "Esql.user_agent_original_values",
129    "Esql.anthropic_audit_actor_type_values",
130    "Esql.timestamp_first_seen",
131    "Esql.timestamp_last_seen",
132]