Anthropic Sensitive Claude Project Role Assigned to User

  1[metadata]
  2creation_date = "2026/09/15"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/23"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when a Claude project owner or editor role is granted through a `role_assignment_granted` event. Project owners
 11and editors can access project chats, artifacts, and knowledge bases that may hold sensitive data. An attacker with
 12organization access can grant these roles to persist access to high-value project content without holding organization
 13admin privileges.
 14"""
 15false_positives = [
 16    """
 17    Legitimate project collaboration routinely adds owners and editors when teams spin up or staff Claude projects.
 18    Verify the project (`anthropic.audit.resource_id`), role, and available actor fields against expected membership
 19    changes.
 20    """,
 21    """
 22    Shared service or automation accounts may receive editor access during content workflows. Confirm the assigner
 23    and affected project are expected for the workflow; grantee identity may require correlating org membership or
 24    `anthropic.audit.target_id` when the API supplies it.
 25    """,
 26]
 27from = "now-9m"
 28index = ["logs-anthropic.audit-*"]
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "Anthropic Sensitive Claude Project Role Assigned to User"
 32note = """## Triage and analysis
 33
 34### Investigating Anthropic Sensitive Claude Project Role Assigned to User
 35
 36First-seen grant of `chat_project:owner` or `chat_project:editor` on a Claude project (`organization.id` +
 37`anthropic.audit.resource_id`). Organization membership `admin` promotions (`claude_user_role_updated`) are covered
 38by **Anthropic Admin Role Assigned to User**. Self-assignment at project creation is common; `user.id` may be absent
 39for `anthropic_actor`.
 40
 41Unauthorized = grant to an unexpected collaborator (especially external), no project onboarding ticket, or followed
 42by export / public artifact sharing / logging changes on the same project. Close as FP for known team staffing with
 43ticket or a recurring collaborator baseline on that project.
 44
 45#### Possible investigation steps
 46
 47- When `user_actor`, identify assigner via email/IP/UA. Review role, `anthropic.audit.resource_id`, and grantee fields
 48  (`anthropic.audit.target_id` / `target_type` / `related.user`) when present.
 49- Correlate with org membership changes, exports, or artifact sharing involving the same project or users.
 50- Escalate when the grantee is new/external or privileged data access follows; close when ticket/baseline matches.
 51
 52### False positive analysis
 53
 54- Routine project staffing and self-assignment at creation are expected — baseline recurring collaborators.
 55
 56### Response and remediation
 57
 58- On unauthorized grant: revoke the project role on that `anthropic.audit.resource_id`, review other changes on the
 59  same project/org, and audit project content access and recent exports.
 60"""
 61references = [
 62    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 63]
 64risk_score = 47
 65rule_id = "28a17de8-c18e-4672-8953-2c2716a3f7b4"
 66severity = "medium"
 67tags = [
 68    "Domain: GenAI",
 69    "Platform: Anthropic",
 70    "Data Source: Anthropic Audit Logs",
 71    "Use Case: Identity and Access Audit",
 72    "Use Case: Threat Detection",
 73    "Use Case: UEBA",
 74    "Resources: Investigation Guide",
 75    "Rule Type: New Terms",
 76    "Tactic: Persistence",
 77    "Tactic: Privilege Escalation",
 78]
 79timestamp_override = "event.ingested"
 80type = "new_terms"
 81
 82query = '''
 83data_stream.dataset: "anthropic.audit" and
 84    event.category: "iam" and
 85    event.action: "role_assignment_granted" and
 86    user.target.roles: ("chat_project:owner" or "chat_project:editor")
 87'''
 88
 89
 90[[rule.threat]]
 91framework = "MITRE ATT&CK"
 92[[rule.threat.technique]]
 93id = "T1098"
 94name = "Account Manipulation"
 95reference = "https://attack.mitre.org/techniques/T1098/"
 96[[rule.threat.technique.subtechnique]]
 97id = "T1098.003"
 98name = "Additional Cloud Roles"
 99reference = "https://attack.mitre.org/techniques/T1098/003/"
100
101
102
103[rule.threat.tactic]
104id = "TA0003"
105name = "Persistence"
106reference = "https://attack.mitre.org/tactics/TA0003/"
107[[rule.threat]]
108framework = "MITRE ATT&CK"
109[[rule.threat.technique]]
110id = "T1098"
111name = "Account Manipulation"
112reference = "https://attack.mitre.org/techniques/T1098/"
113[[rule.threat.technique.subtechnique]]
114id = "T1098.003"
115name = "Additional Cloud Roles"
116reference = "https://attack.mitre.org/techniques/T1098/003/"
117
118
119
120[rule.threat.tactic]
121id = "TA0004"
122name = "Privilege Escalation"
123reference = "https://attack.mitre.org/tactics/TA0004/"
124
125[rule.investigation_fields]
126field_names = [
127    "@timestamp",
128    "event.action",
129    "event.id",
130    "organization.id",
131    "user.id",
132    "user.target.roles",
133    "anthropic.audit.target_id",
134    "anthropic.audit.target_type",
135    "related.user",
136    "anthropic.audit.resource_id",
137    "anthropic.audit.resource_type",
138    "anthropic.audit.actor.type",
139    "user.email",
140    "user.target.id",
141    "source.ip",
142    "user_agent.original",
143]
144
145[rule.new_terms]
146field = "new_terms_fields"
147value = ["organization.id", "anthropic.audit.resource_id"]
148[[rule.new_terms.history_window_start]]
149field = "history_window_start"
150value = "now-14d"