Anthropic Admin Role Assigned to User

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/10/07"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10The organization admin role controls organization settings, integrations, membership, and security configuration in
 11Anthropic Claude for Enterprise. Membership role changes are reported as `claude_user_role_updated` with
 12`anthropic.audit.current_role`. An attacker can promote a compromised or newly invited account to org admin to turn
 13initial access into durable control-plane access. From admin, they can disable SSO, mint admin API keys for automation,
 14start data exports, and weaken audit logging. Workspace-scoped `role_assignment_granted` grants (for example bare
 15`admin` on a workspace) are out of scope for this rule.
 16"""
 17false_positives = [
 18    """
 19    IT administrators promote users to organization admin during onboarding, staffing changes, or incident response.
 20    Verify that the target user should hold org admin privileges, and that a change request exists when policy requires
 21    one.
 22    """,
 23]
 24from = "now-9m"
 25language = "esql"
 26license = "Elastic License v2"
 27name = "Anthropic Admin Role Assigned to User"
 28note = """## Triage and analysis
 29
 30### Investigating Anthropic Admin Role Assigned to User
 31
 32Org admin can change SSO, API keys, exports, and integrations. This rule matches `claude_user_role_updated` where
 33`anthropic.audit.current_role` is the literal `admin` (organization membership role — not workspace
 34`role_assignment_granted`, not project `chat_project:*` roles, not `rbac_role_assigned`).
 35
 36Unauthorized = no IAM ticket naming the target as org admin, target recently invited from an unexpected domain, or
 37the promotion is followed by key creation / SSO weakening / exports by the same actor or target.
 38
 39#### Possible investigation steps
 40
 41- Identify target (`user.target.id`, `user.target.email`, `related.user`) and assigner (`anthropic.audit.actor.type`;
 42  for `user_actor` check email/IP/UA).
 43- Compare `anthropic.audit.previous_role` → `anthropic.audit.current_role` and check whether the target was invited or
 44  otherwise role-changed shortly before becoming admin.
 45- After the promotion, review ~48h of target activity and org IAM (primary owner transfer, admin keys, SSO, exports).
 46- Close as FP when ticket + job function match. Escalate when the change is untracked or precedes control-plane abuse.
 47
 48### False positive analysis
 49
 50- Onboarding and IR staffing promotions to org admin are valid — require change request when policy demands one.
 51
 52### Response and remediation
 53
 54- On unauthorized promotion: revoke org admin (downgrade membership role), rotate credentials for assigner and
 55  target, audit admin API keys and integration changes for the organization.
 56"""
 57references = [
 58    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 59    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 60]
 61risk_score = 73
 62rule_id = "f280afaf-332a-40c9-9213-8e2e717ed320"
 63severity = "high"
 64tags = [
 65    "Domain: GenAI",
 66    "Platform: Anthropic",
 67    "Data Source: Anthropic Audit Logs",
 68    "Use Case: Identity and Access Audit",
 69    "Use Case: Threat Detection",
 70    "Resources: Investigation Guide",
 71    "Rule Type: ES|QL",
 72    "Tactic: Persistence",
 73    "Tactic: Privilege Escalation",
 74    "Mitre Atlas: AML.T0012",
 75]
 76timestamp_override = "event.ingested"
 77type = "esql"
 78
 79query = '''
 80from logs-anthropic.audit-* metadata _id, _version, _index
 81| where
 82    data_stream.dataset == "anthropic.audit" and
 83    mv_contains(event.category, "iam") and
 84    event.action == "claude_user_role_updated" and
 85    anthropic.audit.current_role in ("admin", "owner", "membership_admin")
 86| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 87'''
 88
 89
 90[[rule.threat]]
 91framework = "MITRE ATT&CK"
 92[[rule.threat.technique]]
 93id = "T1098"
 94name = "Account Manipulation"
 95reference = "https://attack.mitre.org/techniques/T1098/"
 96[[rule.threat.technique.subtechnique]]
 97id = "T1098.003"
 98name = "Additional Cloud Roles"
 99reference = "https://attack.mitre.org/techniques/T1098/003/"
100
101
102
103[rule.threat.tactic]
104id = "TA0003"
105name = "Persistence"
106reference = "https://attack.mitre.org/tactics/TA0003/"
107[[rule.threat]]
108framework = "MITRE ATT&CK"
109[[rule.threat.technique]]
110id = "T1098"
111name = "Account Manipulation"
112reference = "https://attack.mitre.org/techniques/T1098/"
113[[rule.threat.technique.subtechnique]]
114id = "T1098.003"
115name = "Additional Cloud Roles"
116reference = "https://attack.mitre.org/techniques/T1098/003/"
117
118
119
120[rule.threat.tactic]
121id = "TA0004"
122name = "Privilege Escalation"
123reference = "https://attack.mitre.org/tactics/TA0004/"
124[[rule.threat_mappings]]
125framework = "MITRE ATLAS"
126version = "2026.08"
127[[rule.threat_mappings.threat]]
128framework = "MITRE ATLAS"
129[[rule.threat_mappings.threat.technique]]
130id = "AML.T0012"
131name = "Valid Accounts"
132reference = "https://atlas.mitre.org/techniques/AML.T0012/"
133
134
135[rule.threat_mappings.threat.tactic]
136id = "AML.TA0012"
137name = "Privilege Escalation"
138reference = "https://atlas.mitre.org/tactics/AML.TA0012/"
139
140[rule.investigation_fields]
141field_names = [
142    "@timestamp",
143    "event.action",
144    "event.id",
145    "organization.id",
146    "user.target.id",
147    "user.target.email",
148    "related.user",
149    "anthropic.audit.current_role",
150    "anthropic.audit.previous_role",
151    "anthropic.audit.actor.type",
152    "user.email",
153    "user.id",
154    "source.ip",
155    "user_agent.original",
156]