Anthropic Organization Deletion

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Organization deletion and bulk delete remove tenant data, projects, and member access in a single administrative action.
 11An attacker can use this to break AI-assisted workflows as an impact technique, to extort the organization, or to
 12destroy evidence after finishing a data export. Once deletion progresses, recovery options shrink and earlier
 13exfiltration activity is harder to reconstruct from the tenant itself.
 14"""
 15false_positives = [
 16    """
 17    Planned tenant offboarding, sandbox teardown, or contract termination can produce these events. Confirm the actor
 18    and timing against change management or offboarding records before escalating.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Organization Deletion"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Organization Deletion
 28
 29Organization deletion / bulk delete removes tenant data, projects, and member access. Treat early actions as urgent —
 30recovery options shrink as the workflow progresses.
 31
 32Unauthorized = no offboarding / lab-teardown ticket naming this org and actor, or deletion preceded by owner transfer,
 33admin grants, key creation, or data exports without a matching business project.
 34
 35#### Possible investigation steps
 36
 37- Identify actor (`user_actor` → email/IP/UA) and `organization.id`.
 38- Urgency by action:
 39  - `org_deletion_requested`: intervene immediately if unauthorized.
 40  - `org_bulk_delete_initiated`: bulk delete started — escalate IR now.
 41  - `org_deleted_via_bulk`: completed — prioritize evidence preservation outside the tenant.
 42- Look for preceding primary owner transfer, admin grants, admin API key creation, or data exports.
 43- Close as FP only when platform owners confirm scheduled decommission with matching ticket/time/actor.
 44
 45### False positive analysis
 46
 47- Sandbox teardown and contract termination are valid — require change management or offboarding records.
 48
 49### Response and remediation
 50
 51- On unauthorized activity: engage Anthropic support and internal IR immediately, preserve remaining audit logs
 52  (including prior exports), and rotate administrative credentials for the organization.
 53"""
 54references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 55risk_score = 99
 56rule_id = "11347993-e71f-4659-a903-e9a0e8bd55de"
 57severity = "critical"
 58tags = [
 59    "Domain: GenAI",
 60    "Platform: Anthropic",
 61    "Data Source: Anthropic Audit Logs",
 62    "Use Case: Threat Detection",
 63    "Resources: Investigation Guide",
 64    "Rule Type: ES|QL",
 65    "Tactic: Impact",
 66]
 67timestamp_override = "event.ingested"
 68type = "esql"
 69
 70query = '''
 71from logs-anthropic.audit-* metadata _id, _version, _index
 72| where
 73    data_stream.dataset == "anthropic.audit" and
 74    mv_contains(event.category, "configuration") and
 75    event.action in ("org_deletion_requested", "org_bulk_delete_initiated", "org_deleted_via_bulk")
 76| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 77'''
 78
 79
 80[[rule.threat]]
 81framework = "MITRE ATT&CK"
 82[[rule.threat.technique]]
 83id = "T1485"
 84name = "Data Destruction"
 85reference = "https://attack.mitre.org/techniques/T1485/"
 86
 87[[rule.threat.technique]]
 88id = "T1531"
 89name = "Account Access Removal"
 90reference = "https://attack.mitre.org/techniques/T1531/"
 91
 92
 93[rule.threat.tactic]
 94id = "TA0040"
 95name = "Impact"
 96reference = "https://attack.mitre.org/tactics/TA0040/"
 97[[rule.threat_mappings]]
 98framework = "MITRE ATLAS"
 99version = "2026.08"
100[[rule.threat_mappings.threat]]
101framework = "MITRE ATLAS"
102
103[rule.threat_mappings.threat.tactic]
104id = "AML.TA0011"
105name = "Impact"
106reference = "https://atlas.mitre.org/tactics/AML.TA0011/"
107
108[rule.investigation_fields]
109field_names = [
110    "@timestamp",
111    "event.action",
112    "event.id",
113    "organization.id",
114    "anthropic.audit.actor.type",
115    "user.email",
116    "user.id",
117    "source.ip",
118    "user_agent.original",
119]