Anthropic Organization Member and Group Enumeration

[metadata]
creation_date = "2026/09/16"
integration = ["anthropic"]
maturity = "production"
updated_date = "2026/09/25"

[rule]
author = ["Elastic"]
description = """
Detects a single user performing at least two distinct organization discovery actions within a 10-minute window: listing
users, exporting members, or viewing groups. Chaining these read actions maps membership and group structure and
commonly precedes targeted role grants, invites, or data collection against high-value accounts.
"""
false_positives = [
    """
    Organization administrators, identity teams, and compliance reviewers may list users, export members, and view
    groups during audits, access reviews, or offboarding. Confirm the actor and change ticket before escalating.
    """,
]
from = "now-11m"
interval = "10m"
language = "esql"
license = "Elastic License v2"
name = "Anthropic Organization Member and Group Enumeration"
note = """## Triage and analysis

### Investigating Anthropic Organization Member and Group Enumeration

One email performed at least two distinct discovery actions among `org_users_listed`, `org_members_exported`, and
`group_list_viewed` in a short window — reconnaissance of who is in the tenant.

Escalate when scripting UA, follow-on invites/role grants/SSO changes/exports appear, or the actor is not an identity
admin. Close as FP for scheduled access reviews or onboarding console browsing with a ticket.

#### Possible investigation steps

- Read `Esql.event_action_values` to see which discovery actions combined; all three in one window is stronger than
  two.
- Inspect IP/UA/actor type for automation or unfamiliar clients.
- Pivot the same actor/org for follow-on admin or project role grants, invites, SSO changes, or data exports.
- Note: some `org_members_exported` without user email (e.g. certain `anthropic_actor` cases) are out of scope.

### False positive analysis

- Membership exports during access reviews commonly combine two of these actions briefly.

### Response and remediation

- On unauthorized recon: revoke sessions, review recent role and invite changes, and tighten least privilege on
  identity read actions where possible.
"""
references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
risk_score = 47
rule_id = "3fe56f6b-75c6-4ba1-88ff-e879145e0e1d"
severity = "medium"
tags = [
    "Domain: GenAI",
    "Platform: Anthropic",
    "Data Source: Anthropic Audit Logs",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Resources: Investigation Guide",
    "Rule Type: ES|QL",
    "Tactic: Discovery",
    "Mitre Atlas: AML.T0075",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-anthropic.audit-*
| where
    data_stream.dataset == "anthropic.audit" and
    event.action in ("org_members_exported", "org_users_listed", "group_list_viewed") and
    user.email is not null
| stats
    Esql.event_action_count_distinct = count_distinct(event.action),
    Esql.event_action_values = values(event.action),
    Esql.event_count = count(*),
    Esql.event_id_values = values(event.id),
    Esql.source_ip_values = values(source.ip),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
    Esql.user_id_values = values(user.id),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.email, organization.id
| where Esql.event_action_count_distinct >= 2
| keep user.email, organization.id, Esql.*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1069"
name = "Permission Groups Discovery"
reference = "https://attack.mitre.org/techniques/T1069/"
[[rule.threat.technique.subtechnique]]
id = "T1069.003"
name = "Cloud Groups"
reference = "https://attack.mitre.org/techniques/T1069/003/"


[[rule.threat.technique]]
id = "T1087"
name = "Account Discovery"
reference = "https://attack.mitre.org/techniques/T1087/"
[[rule.threat.technique.subtechnique]]
id = "T1087.004"
name = "Cloud Account"
reference = "https://attack.mitre.org/techniques/T1087/004/"



[rule.threat.tactic]
id = "TA0007"
name = "Discovery"
reference = "https://attack.mitre.org/tactics/TA0007/"
[[rule.threat_mappings]]
framework = "MITRE ATLAS"
version = "2026.08"
[[rule.threat_mappings.threat]]
framework = "MITRE ATLAS"
[[rule.threat_mappings.threat.technique]]
id = "AML.T0075"
name = "Enterprise Resource Discovery"
reference = "https://atlas.mitre.org/techniques/AML.T0075/"


[rule.threat_mappings.threat.tactic]
id = "AML.TA0008"
name = "Discovery"
reference = "https://atlas.mitre.org/tactics/AML.TA0008/"

[rule.alert_suppression]
group_by = ["user.email", "organization.id"]
missing_fields_strategy = "suppress"

[rule.investigation_fields]
field_names = [
    "user.email",
    "organization.id",
    "Esql.event_action_count_distinct",
    "Esql.event_action_values",
    "Esql.event_count",
    "Esql.event_id_values",
    "Esql.source_ip_values",
    "Esql.user_agent_original_values",
    "Esql.anthropic_audit_actor_type_values",
    "Esql.user_id_values",
    "Esql.timestamp_first_seen",
    "Esql.timestamp_last_seen",
]

[rule.alert_suppression.duration]
unit = "m"
value = 10