Anthropic Organization Deletion

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Organization deletion and bulk delete remove tenant data, projects, and member access in a single administrative
 11action. An attacker can use this to break AI-assisted workflows as an impact technique, to extort the organization, or
 12to destroy evidence after finishing a data export. Once deletion progresses, recovery options shrink and earlier
 13exfiltration activity is harder to reconstruct from the tenant itself.
 14"""
 15false_positives = [
 16    """
 17    Planned tenant offboarding, sandbox teardown, or contract termination can produce these events. Confirm the actor
 18    and timing against change management or offboarding records before escalating.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Organization Deletion"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Organization Deletion
 28
 29Organization deletion / bulk delete removes tenant data, projects, and member access. Treat early actions as urgent —
 30recovery options shrink as the workflow progresses.
 31
 32Unauthorized = no offboarding / lab-teardown ticket naming this org and actor, or deletion preceded by owner transfer,
 33admin grants, key creation, or data exports without a matching business project.
 34
 35#### Possible investigation steps
 36
 37- Identify actor (`user_actor` → email/IP/UA) and `organization.id`.
 38- Urgency by action:
 39  - `org_deletion_requested`: intervene immediately if unauthorized.
 40  - `org_bulk_delete_initiated`: bulk delete started — escalate IR now.
 41  - `org_deleted_via_bulk`: completed — prioritize evidence preservation outside the tenant.
 42- Look for preceding primary owner transfer, admin grants, admin API key creation, or data exports.
 43- Close as FP only when platform owners confirm scheduled decommission with matching ticket/time/actor.
 44
 45### False positive analysis
 46
 47- Sandbox teardown and contract termination are valid — require change management or offboarding records.
 48
 49### Response and remediation
 50
 51- On unauthorized activity: engage Anthropic support and internal IR immediately, preserve remaining audit logs
 52  (including prior exports), and rotate administrative credentials for the organization.
 53"""
 54references = [
 55    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 56]
 57risk_score = 99
 58rule_id = "11347993-e71f-4659-a903-e9a0e8bd55de"
 59severity = "critical"
 60tags = [
 61    "Domain: GenAI",
 62    "Platform: Anthropic",
 63    "Data Source: Anthropic Audit Logs",
 64    "Use Case: Threat Detection",
 65    "Resources: Investigation Guide",
 66    "Rule Type: ES|QL",
 67    "Tactic: Impact",
 68]
 69timestamp_override = "event.ingested"
 70type = "esql"
 71
 72query = '''
 73from logs-anthropic.audit-* metadata _id, _version, _index
 74| where
 75    data_stream.dataset == "anthropic.audit" and
 76    mv_contains(event.category, "configuration") and
 77    event.action in ("org_deletion_requested", "org_bulk_delete_initiated", "org_deleted_via_bulk")
 78| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 79'''
 80
 81
 82[[rule.threat]]
 83framework = "MITRE ATT&CK"
 84[[rule.threat.technique]]
 85id = "T1485"
 86name = "Data Destruction"
 87reference = "https://attack.mitre.org/techniques/T1485/"
 88
 89[[rule.threat.technique]]
 90id = "T1531"
 91name = "Account Access Removal"
 92reference = "https://attack.mitre.org/techniques/T1531/"
 93
 94
 95[rule.threat.tactic]
 96id = "TA0040"
 97name = "Impact"
 98reference = "https://attack.mitre.org/tactics/TA0040/"
 99
100[rule.investigation_fields]
101field_names = [
102    "@timestamp",
103    "event.action",
104    "event.id",
105    "organization.id",
106    "anthropic.audit.actor.type",
107    "user.email",
108    "user.id",
109    "source.ip",
110    "user_agent.original",
111]