Anthropic Organization Domain Boundary Changed

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Verified organization domains control which email addresses can join or be pulled into an Anthropic tenant. Verifying,
 11claiming, adding, or removing a domain changes the tenant boundary and can pull in attacker-controlled mailboxes or push
 12out legitimate corporate domains. These events are infrequent and affect organization-wide membership trust.
 13"""
 14false_positives = [
 15    """
 16    IT and identity teams verify or add corporate domains during tenant onboarding, mergers, or DNS migrations. Confirm
 17    the domain and actor against change management records.
 18    """,
 19]
 20from = "now-9m"
 21language = "esql"
 22license = "Elastic License v2"
 23name = "Anthropic Organization Domain Boundary Changed"
 24note = """## Triage and analysis
 25
 26### Investigating Anthropic Organization Domain Boundary Changed
 27
 28Verified domains control which email domains are trusted for membership. Verifying, adding, removing, or claiming a
 29domain changes the tenant boundary (attacker-controlled mailboxes in, or corporate domains out).
 30
 31Unauthorized = domain not on the corporate allowlist / merger plan, `domain_claim_initiated` without DNS ownership
 32work, or domain change paired with external invites or SSO changes.
 33
 34#### Possible investigation steps
 35
 36- Read `event.action` and `anthropic.audit.domain` (may be empty on `org_domain_add_initiated` /
 37  `domain_claim_initiated` — pivot org + nearby domain events to recover the name).
 38- Validate actor (email/IP/UA for `user_actor`) against identity admins.
 39- For claims/adds, confirm DNS ownership work was planned. Look for related invites, SSO, or membership changes in
 40  the same window.
 41
 42### False positive analysis
 43
 44- New Enterprise onboarding routinely verifies corporate domains — match change management.
 45
 46### Response and remediation
 47
 48- On unauthorized change: revert via Anthropic administration and review users added under the affected domain.
 49"""
 50references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 51risk_score = 73
 52rule_id = "fb3b43e2-0358-4bd0-b8b6-569d7c2baed1"
 53severity = "high"
 54tags = [
 55    "Domain: GenAI",
 56    "Domain: Identity",
 57    "Platform: Anthropic",
 58    "Data Source: Anthropic Audit Logs",
 59    "Use Case: Identity and Access Audit",
 60    "Use Case: Threat Detection",
 61    "Resources: Investigation Guide",
 62    "Rule Type: ES|QL",
 63    "Tactic: Persistence",
 64]
 65timestamp_override = "event.ingested"
 66type = "esql"
 67
 68query = '''
 69from logs-anthropic.audit-* metadata _id, _version, _index
 70| where
 71    data_stream.dataset == "anthropic.audit" and
 72    mv_contains(event.category, "configuration") and
 73    event.action in (
 74        "org_domain_verified",
 75        "org_domain_removed",
 76        "org_domain_add_initiated",
 77        "domain_claim_initiated"
 78    )
 79| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 80'''
 81
 82
 83[[rule.threat]]
 84framework = "MITRE ATT&CK"
 85[[rule.threat.technique]]
 86id = "T1098"
 87name = "Account Manipulation"
 88reference = "https://attack.mitre.org/techniques/T1098/"
 89
 90
 91[rule.threat.tactic]
 92id = "TA0003"
 93name = "Persistence"
 94reference = "https://attack.mitre.org/tactics/TA0003/"
 95[[rule.threat_mappings]]
 96framework = "MITRE ATLAS"
 97version = "2026.08"
 98[[rule.threat_mappings.threat]]
 99framework = "MITRE ATLAS"
100
101[rule.threat_mappings.threat.tactic]
102id = "AML.TA0006"
103name = "Persistence"
104reference = "https://atlas.mitre.org/tactics/AML.TA0006/"
105
106[rule.investigation_fields]
107field_names = [
108    "@timestamp",
109    "event.action",
110    "event.id",
111    "organization.id",
112    "anthropic.audit.domain",
113    "anthropic.audit.actor.type",
114    "user.email",
115    "user.id",
116    "source.ip",
117    "user_agent.original",
118]