Anthropic Excessive Chat Creation

  1[metadata]
  2creation_date = "2026/09/15"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an unusually high number of Claude chat creation events for the same user email within a 24-hour period.
 11Burst chat creation can indicate automated LLM abuse, resource hijacking to burn organizational quotas, or scripted
 12workflows used to stage many parallel conversations for data processing or prompt-injection campaigns.
 13"""
 14false_positives = [
 15    """
 16    Power users, automation engineers, or evaluation scripts that create many short-lived chats during testing can exceed
 17    the threshold without malicious intent.
 18    """,
 19]
 20from = "now-24h"
 21interval = "1h"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Excessive Chat Creation"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Excessive Chat Creation
 28
 29One mailbox created a large burst of Claude chats in 24 hours — fits automation, quota burn, or scripted parallel
 30workflows.
 31
 32True-positive signals: scripting UA (curl/python/Go-http-client), many distinct project IDs, concurrent file uploads
 33or deletions, or follow-on exports. False-positive signals: known eval/load-test accounts, onboarding templates from
 34one admin with browser UA and no data-access follow-ons.
 35
 36#### Possible investigation steps
 37
 38- Prefer alerts with scripting UA and/or many distinct project IDs over browser UA confined to one known project.
 39- Correlate with high file uploads, chat deletions, or org data export from the same email in the same window.
 40
 41### False positive analysis
 42
 43- Known eval/load-test seats and onboarding template creators with browser UA and no data-access follow-ons are FP.
 44
 45### Response and remediation
 46
 47- When TP signals hold: revoke sessions, review project membership, and apply rate limits or policy changes for the
 48  actor.
 49"""
 50references = [
 51    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 52]
 53risk_score = 47
 54rule_id = "854d9932-93c3-42d4-bab0-7723a91df397"
 55severity = "medium"
 56tags = [
 57    "Domain: GenAI",
 58    "Platform: Anthropic",
 59    "Data Source: Anthropic Audit Logs",
 60    "Use Case: Threat Detection",
 61    "Use Case: UEBA",
 62    "Resources: Investigation Guide",
 63    "Rule Type: ES|QL",
 64    "Tactic: Impact",
 65]
 66timestamp_override = "event.ingested"
 67type = "esql"
 68
 69query = '''
 70from logs-anthropic.audit-*
 71| where
 72    data_stream.dataset == "anthropic.audit" and
 73    event.action == "claude_chat_created" and
 74    event.outcome == "success" and
 75    user.email is not null
 76| stats
 77    Esql.event_count = count(*),
 78    Esql.event_id_values = values(event.id),
 79    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
 80    Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id),
 81    Esql.source_ip_values = values(source.ip),
 82    Esql.user_agent_original_values = values(user_agent.original),
 83    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 84    Esql.user_id_values = values(user.id),
 85    Esql.timestamp_first_seen = min(@timestamp),
 86    Esql.timestamp_last_seen = max(@timestamp)
 87  by user.email
 88| where Esql.event_count >= 20
 89| keep user.email, Esql.*
 90'''
 91
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95[[rule.threat.technique]]
 96id = "T1496"
 97name = "Resource Hijacking"
 98reference = "https://attack.mitre.org/techniques/T1496/"
 99
100
101[rule.threat.tactic]
102id = "TA0040"
103name = "Impact"
104reference = "https://attack.mitre.org/tactics/TA0040/"
105
106[rule.alert_suppression]
107group_by = ["user.email"]
108duration = {value = 24, unit = "h"}
109missing_fields_strategy = "suppress"
110
111[rule.investigation_fields]
112field_names = [
113    "user.email",
114    "Esql.event_count",
115    "Esql.event_id_values",
116    "Esql.anthropic_audit_claude_chat_id_values",
117    "Esql.anthropic_audit_claude_project_id_values",
118    "Esql.source_ip_values",
119    "Esql.user_agent_original_values",
120    "Esql.anthropic_audit_actor_type_values",
121    "Esql.user_id_values",
122    "Esql.timestamp_first_seen",
123    "Esql.timestamp_last_seen",
124]