Anthropic Organization Domain Boundary Changed

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/21"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Verified organization domains control which email addresses can join or be pulled into an Anthropic tenant. Verifying,
 11claiming, adding, or removing a domain changes the tenant boundary and can pull in attacker-controlled mailboxes or
 12push out legitimate corporate domains. These events are infrequent and affect organization-wide membership trust.
 13"""
 14false_positives = [
 15    """
 16    IT and identity teams verify or add corporate domains during tenant onboarding, mergers, or DNS migrations.
 17    Confirm the domain and actor against change management records.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "Anthropic Organization Domain Boundary Changed"
 24note = """## Triage and analysis
 25
 26### Investigating Anthropic Organization Domain Boundary Changed
 27
 28Verified domains control which email domains are trusted for membership. Verifying, adding, removing, or claiming a
 29domain changes the tenant boundary (attacker-controlled mailboxes in, or corporate domains out).
 30
 31Unauthorized = domain not on the corporate allowlist / merger plan, `domain_claim_initiated` without DNS ownership
 32work, or domain change paired with external invites or SSO changes.
 33
 34#### Possible investigation steps
 35
 36- Read `event.action` and `anthropic.audit.domain` (may be empty on `org_domain_add_initiated` /
 37  `domain_claim_initiated` — pivot org + nearby domain events to recover the name).
 38- Validate actor (email/IP/UA for `user_actor`) against identity admins.
 39- For claims/adds, confirm DNS ownership work was planned. Look for related invites, SSO, or membership changes in
 40  the same window.
 41
 42### False positive analysis
 43
 44- New Enterprise onboarding routinely verifies corporate domains — match change management.
 45
 46### Response and remediation
 47
 48- On unauthorized change: revert via Anthropic administration and review users added under the affected domain.
 49"""
 50references = [
 51    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 52]
 53risk_score = 73
 54rule_id = "fb3b43e2-0358-4bd0-b8b6-569d7c2baed1"
 55severity = "high"
 56tags = [
 57    "Domain: GenAI",
 58    "Platform: Anthropic",
 59    "Data Source: Anthropic Audit Logs",
 60    "Use Case: Identity and Access Audit",
 61    "Use Case: Threat Detection",
 62    "Resources: Investigation Guide",
 63    "Rule Type: ES|QL",
 64    "Tactic: Persistence",
 65]
 66timestamp_override = "event.ingested"
 67type = "esql"
 68
 69query = '''
 70from logs-anthropic.audit-* metadata _id, _version, _index
 71| where
 72    data_stream.dataset == "anthropic.audit" and
 73    mv_contains(event.category, "configuration") and
 74    event.action in (
 75        "org_domain_verified",
 76        "org_domain_removed",
 77        "org_domain_add_initiated",
 78        "domain_claim_initiated"
 79    )
 80| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 81'''
 82
 83
 84[[rule.threat]]
 85framework = "MITRE ATT&CK"
 86[[rule.threat.technique]]
 87id = "T1098"
 88name = "Account Manipulation"
 89reference = "https://attack.mitre.org/techniques/T1098/"
 90
 91
 92[rule.threat.tactic]
 93id = "TA0003"
 94name = "Persistence"
 95reference = "https://attack.mitre.org/tactics/TA0003/"
 96
 97[rule.investigation_fields]
 98field_names = [
 99    "@timestamp",
100    "event.action",
101    "event.id",
102    "organization.id",
103    "anthropic.audit.domain",
104    "anthropic.audit.actor.type",
105    "user.email",
106    "user.id",
107    "source.ip",
108    "user_agent.original",
109]