Anthropic High File Upload Activity

  1[metadata]
  2creation_date = "2026/09/15"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an unusually high volume of Claude file uploads from the same user email and source IP within a rolling 24-hour
 11period. Sustained upload activity can indicate staging of sensitive documents in Claude chats for later retrieval,
 12automated ingestion of data into LLM workflows, or abuse of organizational Claude access to move files into the cloud
 13service.
 14"""
 15false_positives = [
 16    """
 17    Developers, analysts, or knowledge workers bulk-uploading documents during migrations, evaluations, or large project
 18    onboarding can exceed the daily threshold from a single workstation or VPN egress.
 19    """,
 20]
 21from = "now-24h"
 22interval = "1h"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "Anthropic High File Upload Activity"
 26note = """## Triage and analysis
 27
 28### Investigating Anthropic High File Upload Activity
 29
 30One `user.email` + `source.ip` pair uploaded a large volume of Claude files in 24 hours — possible staging for later
 31retrieval, automated ingestion, or abuse of org Claude access.
 32
 33Unauthorized / escalate when filenames look sensitive, uploads target shared/sensitive projects, UA looks automated
 34(curl/python vs browser), or artifact sharing / exports follow. Close as FP for documented migrations, RAG pilots, or
 35batch attach jobs with expected project IDs.
 36
 37#### Possible investigation steps
 38
 39- Start with `Esql.event_count`, `Esql.file_name_values`, and chat/project ID lists — sensitive names or shared
 40  project IDs raise priority.
 41- Triage `user_agent` on raw uploads: browser-like vs scripting clients. Scripting UAs with many distinct file IDs
 42  look more like automation than interactive work.
 43- Pivot raw `logs-anthropic.audit-*` for individual `anthropic.audit.claude_file_id` / filenames and whether
 44  `claude_file_viewed` or chat activity matches the upload volume.
 45- Correlate with artifact sharing, data exports, or compliance key creation from the same user.
 46
 47### False positive analysis
 48
 49- Document migrations and RAG indexing from one seat commonly exceed the threshold.
 50
 51### Response and remediation
 52
 53- On unauthorized staging: revoke sessions, review uploaded names/file IDs for sensitive content, and tighten project
 54  sharing or upload policy for the actor.
 55"""
 56references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 57risk_score = 47
 58rule_id = "58295a79-5dde-4fc9-a967-2dbe39fb8bc7"
 59severity = "medium"
 60tags = [
 61    "Domain: GenAI",
 62    "Platform: Anthropic",
 63    "Data Source: Anthropic Audit Logs",
 64    "Use Case: Threat Detection",
 65    "Use Case: UEBA",
 66    "Resources: Investigation Guide",
 67    "Rule Type: ES|QL",
 68    "Tactic: Exfiltration",
 69    "Mitre Atlas: AML.T0025",
 70]
 71timestamp_override = "event.ingested"
 72type = "esql"
 73
 74query = '''
 75from logs-anthropic.audit-*
 76| where
 77    data_stream.dataset == "anthropic.audit" and
 78    event.action == "claude_file_uploaded" and
 79    event.outcome == "success" and
 80    user.email is not null and
 81    source.ip is not null
 82| stats
 83    Esql.event_count = count(*),
 84    Esql.event_id_values = values(event.id),
 85    Esql.file_name_values = values(file.name),
 86    Esql.anthropic_audit_claude_file_id_values = values(anthropic.audit.claude_file_id),
 87    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
 88    Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id),
 89    Esql.user_agent_original_values = values(user_agent.original),
 90    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 91    Esql.timestamp_first_seen = min(@timestamp),
 92    Esql.timestamp_last_seen = max(@timestamp)
 93  by user.email, source.ip
 94| where Esql.event_count >= 100
 95| keep user.email, source.ip, Esql.*
 96'''
 97
 98
 99[[rule.threat]]
100framework = "MITRE ATT&CK"
101[[rule.threat.technique]]
102id = "T1567"
103name = "Exfiltration Over Web Service"
104reference = "https://attack.mitre.org/techniques/T1567/"
105
106
107[rule.threat.tactic]
108id = "TA0010"
109name = "Exfiltration"
110reference = "https://attack.mitre.org/tactics/TA0010/"
111[[rule.threat_mappings]]
112framework = "MITRE ATLAS"
113version = "2026.08"
114[[rule.threat_mappings.threat]]
115framework = "MITRE ATLAS"
116[[rule.threat_mappings.threat.technique]]
117id = "AML.T0025"
118name = "Exfiltration via Cyber Means"
119reference = "https://atlas.mitre.org/techniques/AML.T0025/"
120
121
122[rule.threat_mappings.threat.tactic]
123id = "AML.TA0010"
124name = "Exfiltration"
125reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
126
127[rule.alert_suppression]
128group_by = ["user.email", "source.ip"]
129missing_fields_strategy = "suppress"
130
131[rule.investigation_fields]
132field_names = [
133    "user.email",
134    "source.ip",
135    "Esql.event_count",
136    "Esql.event_id_values",
137    "Esql.file_name_values",
138    "Esql.anthropic_audit_claude_file_id_values",
139    "Esql.anthropic_audit_claude_chat_id_values",
140    "Esql.anthropic_audit_claude_project_id_values",
141    "Esql.user_agent_original_values",
142    "Esql.anthropic_audit_actor_type_values",
143    "Esql.timestamp_first_seen",
144    "Esql.timestamp_last_seen",
145]
146
147[rule.alert_suppression.duration]
148unit = "h"
149value = 24