Anthropic Sensitive Claude Project Role Assigned to User

[metadata]
creation_date = "2026/09/15"
integration = ["anthropic"]
maturity = "production"
updated_date = "2026/09/25"

[rule]
author = ["Elastic"]
description = """
Detects when a Claude project owner or editor role is granted through a `role_assignment_granted` event. Project owners
and editors can access project chats, artifacts, and knowledge bases that may hold sensitive data. An attacker with
organization access can grant these roles to persist access to high-value project content without holding organization
admin privileges.
"""
false_positives = [
    """
    Legitimate project collaboration routinely adds owners and editors when teams spin up or staff Claude projects.
    Verify the project (`anthropic.audit.resource_id`), role, and available actor fields against expected membership
    changes.
    """,
    """
    Shared service or automation accounts may receive editor access during content workflows. Confirm the assigner and
    affected project are expected for the workflow; grantee identity may require correlating org membership or
    `anthropic.audit.target_id` when the API supplies it.
    """,
]
from = "now-9m"
index = ["logs-anthropic.audit-*"]
language = "kuery"
license = "Elastic License v2"
name = "Anthropic Sensitive Claude Project Role Assigned to User"
note = """## Triage and analysis

### Investigating Anthropic Sensitive Claude Project Role Assigned to User

First-seen grant of `chat_project:owner` or `chat_project:editor` on a Claude project (`organization.id` +
`anthropic.audit.resource_id`). Organization membership `admin` promotions (`claude_user_role_updated`) are covered
by **Anthropic Admin Role Assigned to User**. Self-assignment at project creation is common; `user.id` may be absent
for `anthropic_actor`.

Unauthorized = grant to an unexpected collaborator (especially external), no project onboarding ticket, or followed
by export / public artifact sharing / logging changes on the same project. Close as FP for known team staffing with
ticket or a recurring collaborator baseline on that project.

#### Possible investigation steps

- When `user_actor`, identify assigner via email/IP/UA. Review role, `anthropic.audit.resource_id`, and grantee fields
  (`anthropic.audit.target_id` / `target_type` / `related.user`) when present.
- Correlate with org membership changes, exports, or artifact sharing involving the same project or users.
- Escalate when the grantee is new/external or privileged data access follows; close when ticket/baseline matches.

### False positive analysis

- Routine project staffing and self-assignment at creation are expected — baseline recurring collaborators.

### Response and remediation

- On unauthorized grant: revoke the project role on that `anthropic.audit.resource_id`, review other changes on the
  same project/org, and audit project content access and recent exports.
"""
references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
risk_score = 47
rule_id = "28a17de8-c18e-4672-8953-2c2716a3f7b4"
severity = "medium"
tags = [
    "Domain: GenAI",
    "Platform: Anthropic",
    "Data Source: Anthropic Audit Logs",
    "Use Case: Identity and Access Audit",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Resources: Investigation Guide",
    "Rule Type: New Terms",
    "Tactic: Persistence",
    "Tactic: Privilege Escalation",
    "Mitre Atlas: AML.T0012",
]
timestamp_override = "event.ingested"
type = "new_terms"

query = '''
data_stream.dataset: "anthropic.audit" and
    event.category: "iam" and
    event.action: "role_assignment_granted" and
    user.target.roles: ("chat_project:owner" or "chat_project:editor")
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"



[rule.threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1098"
name = "Account Manipulation"
reference = "https://attack.mitre.org/techniques/T1098/"
[[rule.threat.technique.subtechnique]]
id = "T1098.003"
name = "Additional Cloud Roles"
reference = "https://attack.mitre.org/techniques/T1098/003/"



[rule.threat.tactic]
id = "TA0004"
name = "Privilege Escalation"
reference = "https://attack.mitre.org/tactics/TA0004/"
[[rule.threat_mappings]]
framework = "MITRE ATLAS"
version = "2026.08"
[[rule.threat_mappings.threat]]
framework = "MITRE ATLAS"
[[rule.threat_mappings.threat.technique]]
id = "AML.T0012"
name = "Valid Accounts"
reference = "https://atlas.mitre.org/techniques/AML.T0012/"


[rule.threat_mappings.threat.tactic]
id = "AML.TA0012"
name = "Privilege Escalation"
reference = "https://atlas.mitre.org/tactics/AML.TA0012/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "event.id",
    "organization.id",
    "user.id",
    "user.target.roles",
    "anthropic.audit.target_id",
    "anthropic.audit.target_type",
    "related.user",
    "anthropic.audit.resource_id",
    "anthropic.audit.resource_type",
    "anthropic.audit.actor.type",
    "user.email",
    "user.target.id",
    "source.ip",
    "user_agent.original",
]

[rule.new_terms]
field = "new_terms_fields"
value = ["organization.id", "anthropic.audit.resource_id"]
[[rule.new_terms.history_window_start]]
field = "history_window_start"
value = "now-14d"