Anthropic Primary Owner Transferred

  1[metadata]
  2creation_date = "2026/09/12"
  3integration = ["anthropic"]
  4maturity = "production"
  5updated_date = "2026/09/23"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Primary ownership is the highest administrative authority in an Anthropic organization, covering billing, membership,
 11and organization-wide settings. Transferring ownership to an attacker-controlled account can lock out the legitimate
 12administrator from recovery paths that depend on the original owner. Attackers often do this after role escalation so
 13defenders cannot reverse earlier privilege changes through normal administration.
 14"""
 15false_positives = [
 16    """
 17    Organizations transfer primary ownership during reorganizations, administrator departures, or vendor transitions.
 18    Verify both the previous and new owner with internal stakeholders before treating the event as malicious.
 19    """,
 20]
 21from = "now-9m"
 22language = "esql"
 23license = "Elastic License v2"
 24name = "Anthropic Primary Owner Transferred"
 25note = """## Triage and analysis
 26
 27### Investigating Anthropic Primary Owner Transferred
 28
 29Primary ownership is the highest Anthropic org authority (billing, membership, org-wide settings). Transfers should
 30be rare and ticketed. Actor fields identify who initiated the transfer — not the new owner
 31(`anthropic.audit.previous_owner_id` / `new_owner_id`).
 32
 33Unauthorized = no HR/IT offboarding or ownership-change ticket naming both parties, or the new owner was recently
 34invited / granted admin and immediately received ownership, especially with follow-on SSO/key/export changes.
 35
 36#### Possible investigation steps
 37
 38- Map `anthropic.audit.previous_owner_id` → `new_owner_id` and resolve initiator (`actor.type`; for `user_actor`
 39  check email/IP/UA).
 40- Before the transfer: look for `claude_user_role_updated` with `anthropic.audit.current_role: admin`, invite accept,
 41  or admin API key creation for the new owner path.
 42- After the transfer: look for SSO changes, exports, compliance logging disablement, or IP restriction deletes by the
 43  new owner.
 44- Contact previous and new owners only after ticket/timeline triage; escalate when ticket is missing or the new owner
 45  chain looks staged.
 46
 47### False positive analysis
 48
 49- Reorgs and admin departures are valid — require matching change management / HR records.
 50
 51### Response and remediation
 52
 53- On unauthorized transfer: engage Anthropic support and internal IT to recover ownership, revoke the new owner's
 54  sessions/keys, and review every admin change made under the new owner account.
 55"""
 56references = [
 57    "https://platform.claude.com/docs/en/api/compliance/activities/list",
 58]
 59risk_score = 73
 60rule_id = "b39aa7b1-b77a-4bd0-84fc-b638ccb29224"
 61severity = "high"
 62tags = [
 63    "Domain: GenAI",
 64    "Platform: Anthropic",
 65    "Data Source: Anthropic Audit Logs",
 66    "Use Case: Identity and Access Audit",
 67    "Use Case: Threat Detection",
 68    "Resources: Investigation Guide",
 69    "Rule Type: ES|QL",
 70    "Tactic: Privilege Escalation",
 71]
 72timestamp_override = "event.ingested"
 73type = "esql"
 74
 75query = '''
 76from logs-anthropic.audit-* metadata _id, _version, _index
 77| where
 78    data_stream.dataset == "anthropic.audit" and
 79    mv_contains(event.category, "iam") and
 80    event.action == "primary_owner_transferred" and
 81    event.outcome == "success"
 82| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*
 83'''
 84
 85
 86[[rule.threat]]
 87framework = "MITRE ATT&CK"
 88[[rule.threat.technique]]
 89id = "T1098"
 90name = "Account Manipulation"
 91reference = "https://attack.mitre.org/techniques/T1098/"
 92[[rule.threat.technique.subtechnique]]
 93id = "T1098.003"
 94name = "Additional Cloud Roles"
 95reference = "https://attack.mitre.org/techniques/T1098/003/"
 96
 97
 98[rule.threat.tactic]
 99id = "TA0004"
100name = "Privilege Escalation"
101reference = "https://attack.mitre.org/tactics/TA0004/"
102
103[rule.investigation_fields]
104field_names = [
105    "@timestamp",
106    "event.action",
107    "event.id",
108    "organization.id",
109    "anthropic.audit.previous_owner_id",
110    "anthropic.audit.new_owner_id",
111    "anthropic.audit.actor.type",
112    "user.email",
113    "user.id",
114    "source.ip",
115    "user_agent.original",
116]