Anthropic Excessive Chat Creation

  1[metadata]
  2creation_date = "2026/09/15"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an unusually high number of Claude chat creation events for the same user email within a 24-hour period. Burst
 11chat creation can indicate automated LLM abuse, resource hijacking to burn organizational quotas, or scripted workflows
 12used to stage many parallel conversations for data processing or prompt-injection campaigns.
 13"""
 14false_positives = [
 15    """
 16    Power users, automation engineers, or evaluation scripts that create many short-lived chats during testing can
 17    exceed the threshold without malicious intent.
 18    """,
 19]
 20from = "now-24h"
 21interval = "1h"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Excessive Chat Creation"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Excessive Chat Creation
 28
 29One mailbox created a large burst of Claude chats in 24 hours — fits automation, quota burn, or scripted parallel
 30workflows.
 31
 32True-positive signals: scripting UA (curl/python/Go-http-client), many distinct project IDs, concurrent file uploads
 33or deletions, or follow-on exports. False-positive signals: known eval/load-test accounts, onboarding templates from
 34one admin with browser UA and no data-access follow-ons.
 35
 36#### Possible investigation steps
 37
 38- Prefer alerts with scripting UA and/or many distinct project IDs over browser UA confined to one known project.
 39- Correlate with high file uploads, chat deletions, or org data export from the same email in the same window.
 40
 41### False positive analysis
 42
 43- Known eval/load-test seats and onboarding template creators with browser UA and no data-access follow-ons are FP.
 44
 45### Response and remediation
 46
 47- When TP signals hold: revoke sessions, review project membership, and apply rate limits or policy changes for the
 48  actor.
 49"""
 50references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 51risk_score = 47
 52rule_id = "854d9932-93c3-42d4-bab0-7723a91df397"
 53severity = "medium"
 54tags = [
 55    "Domain: GenAI",
 56    "Platform: Anthropic",
 57    "Data Source: Anthropic Audit Logs",
 58    "Use Case: Threat Detection",
 59    "Use Case: UEBA",
 60    "Resources: Investigation Guide",
 61    "Rule Type: ES|QL",
 62    "Tactic: Impact",
 63    "Mitre Atlas: AML.T0034",
 64]
 65timestamp_override = "event.ingested"
 66type = "esql"
 67
 68query = '''
 69from logs-anthropic.audit-*
 70| where
 71    data_stream.dataset == "anthropic.audit" and
 72    event.action == "claude_chat_created" and
 73    event.outcome == "success" and
 74    user.email is not null
 75| stats
 76    Esql.event_count = count(*),
 77    Esql.event_id_values = values(event.id),
 78    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
 79    Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id),
 80    Esql.source_ip_values = values(source.ip),
 81    Esql.user_agent_original_values = values(user_agent.original),
 82    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
 83    Esql.user_id_values = values(user.id),
 84    Esql.timestamp_first_seen = min(@timestamp),
 85    Esql.timestamp_last_seen = max(@timestamp)
 86  by user.email
 87| where Esql.event_count >= 20
 88| keep user.email, Esql.*
 89'''
 90
 91
 92[[rule.threat]]
 93framework = "MITRE ATT&CK"
 94[[rule.threat.technique]]
 95id = "T1496"
 96name = "Resource Hijacking"
 97reference = "https://attack.mitre.org/techniques/T1496/"
 98
 99
100[rule.threat.tactic]
101id = "TA0040"
102name = "Impact"
103reference = "https://attack.mitre.org/tactics/TA0040/"
104[[rule.threat_mappings]]
105framework = "MITRE ATLAS"
106version = "2026.08"
107[[rule.threat_mappings.threat]]
108framework = "MITRE ATLAS"
109[[rule.threat_mappings.threat.technique]]
110id = "AML.T0034"
111name = "Cost Harvesting"
112reference = "https://atlas.mitre.org/techniques/AML.T0034/"
113
114
115[rule.threat_mappings.threat.tactic]
116id = "AML.TA0011"
117name = "Impact"
118reference = "https://atlas.mitre.org/tactics/AML.TA0011/"
119
120[rule.alert_suppression]
121group_by = ["user.email"]
122missing_fields_strategy = "suppress"
123
124[rule.investigation_fields]
125field_names = [
126    "user.email",
127    "Esql.event_count",
128    "Esql.event_id_values",
129    "Esql.anthropic_audit_claude_chat_id_values",
130    "Esql.anthropic_audit_claude_project_id_values",
131    "Esql.source_ip_values",
132    "Esql.user_agent_original_values",
133    "Esql.anthropic_audit_actor_type_values",
134    "Esql.user_id_values",
135    "Esql.timestamp_first_seen",
136    "Esql.timestamp_last_seen",
137]
138
139[rule.alert_suppression.duration]
140unit = "h"
141value = 24