Anthropic Sensitive Claude Project Role Assigned to User

  1[metadata]
  2creation_date = "2026/09/15"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when a Claude project owner or editor role is granted through a `role_assignment_granted` event. Project owners
 11and editors can access project chats, artifacts, and knowledge bases that may hold sensitive data. An attacker with
 12organization access can grant these roles to persist access to high-value project content without holding organization
 13admin privileges.
 14"""
 15false_positives = [
 16    """
 17    Legitimate project collaboration routinely adds owners and editors when teams spin up or staff Claude projects.
 18    Verify the project (`anthropic.audit.resource_id`), role, and available actor fields against expected membership
 19    changes.
 20    """,
 21    """
 22    Shared service or automation accounts may receive editor access during content workflows. Confirm the assigner and
 23    affected project are expected for the workflow; grantee identity may require correlating org membership or
 24    `anthropic.audit.target_id` when the API supplies it.
 25    """,
 26]
 27from = "now-9m"
 28index = ["logs-anthropic.audit-*"]
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "Anthropic Sensitive Claude Project Role Assigned to User"
 32note = """## Triage and analysis
 33
 34### Investigating Anthropic Sensitive Claude Project Role Assigned to User
 35
 36First-seen grant of `chat_project:owner` or `chat_project:editor` on a Claude project (`organization.id` +
 37`anthropic.audit.resource_id`). Organization membership `admin` promotions (`claude_user_role_updated`) are covered
 38by **Anthropic Admin Role Assigned to User**. Self-assignment at project creation is common; `user.id` may be absent
 39for `anthropic_actor`.
 40
 41Unauthorized = grant to an unexpected collaborator (especially external), no project onboarding ticket, or followed
 42by export / public artifact sharing / logging changes on the same project. Close as FP for known team staffing with
 43ticket or a recurring collaborator baseline on that project.
 44
 45#### Possible investigation steps
 46
 47- When `user_actor`, identify assigner via email/IP/UA. Review role, `anthropic.audit.resource_id`, and grantee fields
 48  (`anthropic.audit.target_id` / `target_type` / `related.user`) when present.
 49- Correlate with org membership changes, exports, or artifact sharing involving the same project or users.
 50- Escalate when the grantee is new/external or privileged data access follows; close when ticket/baseline matches.
 51
 52### False positive analysis
 53
 54- Routine project staffing and self-assignment at creation are expected — baseline recurring collaborators.
 55
 56### Response and remediation
 57
 58- On unauthorized grant: revoke the project role on that `anthropic.audit.resource_id`, review other changes on the
 59  same project/org, and audit project content access and recent exports.
 60"""
 61references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
 62risk_score = 47
 63rule_id = "28a17de8-c18e-4672-8953-2c2716a3f7b4"
 64severity = "medium"
 65tags = [
 66    "Domain: GenAI",
 67    "Platform: Anthropic",
 68    "Data Source: Anthropic Audit Logs",
 69    "Use Case: Identity and Access Audit",
 70    "Use Case: Threat Detection",
 71    "Use Case: UEBA",
 72    "Resources: Investigation Guide",
 73    "Rule Type: New Terms",
 74    "Tactic: Persistence",
 75    "Tactic: Privilege Escalation",
 76    "Mitre Atlas: AML.T0012",
 77]
 78timestamp_override = "event.ingested"
 79type = "new_terms"
 80
 81query = '''
 82data_stream.dataset: "anthropic.audit" and
 83    event.category: "iam" and
 84    event.action: "role_assignment_granted" and
 85    user.target.roles: ("chat_project:owner" or "chat_project:editor")
 86'''
 87
 88
 89[[rule.threat]]
 90framework = "MITRE ATT&CK"
 91[[rule.threat.technique]]
 92id = "T1098"
 93name = "Account Manipulation"
 94reference = "https://attack.mitre.org/techniques/T1098/"
 95[[rule.threat.technique.subtechnique]]
 96id = "T1098.003"
 97name = "Additional Cloud Roles"
 98reference = "https://attack.mitre.org/techniques/T1098/003/"
 99
100
101
102[rule.threat.tactic]
103id = "TA0003"
104name = "Persistence"
105reference = "https://attack.mitre.org/tactics/TA0003/"
106[[rule.threat]]
107framework = "MITRE ATT&CK"
108[[rule.threat.technique]]
109id = "T1098"
110name = "Account Manipulation"
111reference = "https://attack.mitre.org/techniques/T1098/"
112[[rule.threat.technique.subtechnique]]
113id = "T1098.003"
114name = "Additional Cloud Roles"
115reference = "https://attack.mitre.org/techniques/T1098/003/"
116
117
118
119[rule.threat.tactic]
120id = "TA0004"
121name = "Privilege Escalation"
122reference = "https://attack.mitre.org/tactics/TA0004/"
123[[rule.threat_mappings]]
124framework = "MITRE ATLAS"
125version = "2026.08"
126[[rule.threat_mappings.threat]]
127framework = "MITRE ATLAS"
128[[rule.threat_mappings.threat.technique]]
129id = "AML.T0012"
130name = "Valid Accounts"
131reference = "https://atlas.mitre.org/techniques/AML.T0012/"
132
133
134[rule.threat_mappings.threat.tactic]
135id = "AML.TA0012"
136name = "Privilege Escalation"
137reference = "https://atlas.mitre.org/tactics/AML.TA0012/"
138
139[rule.investigation_fields]
140field_names = [
141    "@timestamp",
142    "event.action",
143    "event.id",
144    "organization.id",
145    "user.id",
146    "user.target.roles",
147    "anthropic.audit.target_id",
148    "anthropic.audit.target_type",
149    "related.user",
150    "anthropic.audit.resource_id",
151    "anthropic.audit.resource_type",
152    "anthropic.audit.actor.type",
153    "user.email",
154    "user.target.id",
155    "source.ip",
156    "user_agent.original",
157]
158
159[rule.new_terms]
160field = "new_terms_fields"
161value = ["organization.id", "anthropic.audit.resource_id"]
162[[rule.new_terms.history_window_start]]
163field = "history_window_start"
164value = "now-14d"