Anthropic Admin Role Assigned to User

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/23"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10The organization admin role controls organization settings, integrations, membership, and security configuration in
 11Anthropic Claude for Enterprise. Membership role changes are reported as `claude_user_role_updated` with
 12`anthropic.audit.current_role`. An attacker can promote a compromised or newly invited account to org admin to turn
 13initial access into durable control-plane access. From admin, they can disable SSO, mint admin API keys for
 14automation, start data exports, and weaken audit logging. Workspace-scoped `role_assignment_granted` grants (for
 15example bare `admin` on a workspace) are out of scope for this rule.
 16"""
 17false_positives = [
 18    """
 19    IT administrators promote users to organization admin during onboarding, staffing changes, or incident response.
 20    Verify that the target user should hold org admin privileges, and that a change request exists when policy
 21    requires one.
 22    """,
 23]
 24from = "now-9m"
 25language = "esql"
 26license = "Elastic License v2"
 27name = "Anthropic Admin Role Assigned to User"
 28note = """## Triage and analysis
 29
 30### Investigating Anthropic Admin Role Assigned to User
 31
 32Org admin can change SSO, API keys, exports, and integrations. This rule matches `claude_user_role_updated` where
 33`anthropic.audit.current_role` is the literal `admin` (organization membership role — not workspace
 34`role_assignment_granted`, not project `chat_project:*` roles, not `rbac_role_assigned`).
 35
 36Unauthorized = no IAM ticket naming the target as org admin, target recently invited from an unexpected domain, or
 37the promotion is followed by key creation / SSO weakening / exports by the same actor or target.
 38
 39#### Possible investigation steps
 40
 41- Identify target (`user.target.id`, `user.target.email`, `related.user`) and assigner (`anthropic.audit.actor.type`;
 42  for `user_actor` check email/IP/UA).
 43- Compare `anthropic.audit.previous_role` → `anthropic.audit.current_role` and check whether the target was invited or
 44  otherwise role-changed shortly before becoming admin.
 45- After the promotion, review ~48h of target activity and org IAM (primary owner transfer, admin keys, SSO, exports).
 46- Close as FP when ticket + job function match. Escalate when the change is untracked or precedes control-plane abuse.
 47
 48### False positive analysis
 49
 50- Onboarding and IR staffing promotions to org admin are valid — require change request when policy demands one.
 51
 52### Response and remediation
 53
 54- On unauthorized promotion: revoke org admin (downgrade membership role), rotate credentials for assigner and
 55  target, audit admin API keys and integration changes for the organization.
 56"""
 57references = [
 58    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 59    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 60]
 61risk_score = 73
 62rule_id = "f280afaf-332a-40c9-9213-8e2e717ed320"
 63severity = "high"
 64tags = [
 65    "Domain: GenAI",
 66    "Platform: Anthropic",
 67    "Data Source: Anthropic Audit Logs",
 68    "Use Case: Identity and Access Audit",
 69    "Use Case: Threat Detection",
 70    "Resources: Investigation Guide",
 71    "Rule Type: ES|QL",
 72    "Tactic: Persistence",
 73    "Tactic: Privilege Escalation",
 74]
 75timestamp_override = "event.ingested"
 76type = "esql"
 77
 78query = '''
 79from logs-anthropic.audit-* metadata _id, _version, _index
 80| where
 81    data_stream.dataset == "anthropic.audit" and
 82    mv_contains(event.category, "iam") and
 83    event.action == "claude_user_role_updated" and
 84    anthropic.audit.current_role == "admin"
 85| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 86'''
 87
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91[[rule.threat.technique]]
 92id = "T1098"
 93name = "Account Manipulation"
 94reference = "https://attack.mitre.org/techniques/T1098/"
 95[[rule.threat.technique.subtechnique]]
 96id = "T1098.003"
 97name = "Additional Cloud Roles"
 98reference = "https://attack.mitre.org/techniques/T1098/003/"
 99
100
101
102[rule.threat.tactic]
103id = "TA0003"
104name = "Persistence"
105reference = "https://attack.mitre.org/tactics/TA0003/"
106[[rule.threat]]
107framework = "MITRE ATT&CK"
108[[rule.threat.technique]]
109id = "T1098"
110name = "Account Manipulation"
111reference = "https://attack.mitre.org/techniques/T1098/"
112[[rule.threat.technique.subtechnique]]
113id = "T1098.003"
114name = "Additional Cloud Roles"
115reference = "https://attack.mitre.org/techniques/T1098/003/"
116
117
118
119[rule.threat.tactic]
120id = "TA0004"
121name = "Privilege Escalation"
122reference = "https://attack.mitre.org/tactics/TA0004/"
123
124[rule.investigation_fields]
125field_names = [
126    "@timestamp",
127    "event.action",
128    "event.id",
129    "organization.id",
130    "user.target.id",
131    "user.target.email",
132    "related.user",
133    "anthropic.audit.current_role",
134    "anthropic.audit.previous_role",
135    "anthropic.audit.actor.type",
136    "user.email",
137    "user.id",
138    "source.ip",
139    "user_agent.original",
140]