Anthropic High File Upload Activity

[metadata]
creation_date = "2026/09/15"
integration = ["anthropic"]
maturity = "production"
updated_date = "2026/09/25"

[rule]
author = ["Elastic"]
description = """
Detects an unusually high volume of Claude file uploads from the same user email and source IP within a rolling 24-hour
period. Sustained upload activity can indicate staging of sensitive documents in Claude chats for later retrieval,
automated ingestion of data into LLM workflows, or abuse of organizational Claude access to move files into the cloud
service.
"""
false_positives = [
    """
    Developers, analysts, or knowledge workers bulk-uploading documents during migrations, evaluations, or large project
    onboarding can exceed the daily threshold from a single workstation or VPN egress.
    """,
]
from = "now-24h"
interval = "1h"
language = "esql"
license = "Elastic License v2"
name = "Anthropic High File Upload Activity"
note = """## Triage and analysis

### Investigating Anthropic High File Upload Activity

One `user.email` + `source.ip` pair uploaded a large volume of Claude files in 24 hours — possible staging for later
retrieval, automated ingestion, or abuse of org Claude access.

Unauthorized / escalate when filenames look sensitive, uploads target shared/sensitive projects, UA looks automated
(curl/python vs browser), or artifact sharing / exports follow. Close as FP for documented migrations, RAG pilots, or
batch attach jobs with expected project IDs.

#### Possible investigation steps

- Start with `Esql.event_count`, `Esql.file_name_values`, and chat/project ID lists — sensitive names or shared
  project IDs raise priority.
- Triage `user_agent` on raw uploads: browser-like vs scripting clients. Scripting UAs with many distinct file IDs
  look more like automation than interactive work.
- Pivot raw `logs-anthropic.audit-*` for individual `anthropic.audit.claude_file_id` / filenames and whether
  `claude_file_viewed` or chat activity matches the upload volume.
- Correlate with artifact sharing, data exports, or compliance key creation from the same user.

### False positive analysis

- Document migrations and RAG indexing from one seat commonly exceed the threshold.

### Response and remediation

- On unauthorized staging: revoke sessions, review uploaded names/file IDs for sensitive content, and tighten project
  sharing or upload policy for the actor.
"""
references = ["https://platform.claude.com/docs/en/api/compliance/activities/list"]
risk_score = 47
rule_id = "58295a79-5dde-4fc9-a967-2dbe39fb8bc7"
severity = "medium"
tags = [
    "Domain: GenAI",
    "Platform: Anthropic",
    "Data Source: Anthropic Audit Logs",
    "Use Case: Threat Detection",
    "Use Case: UEBA",
    "Resources: Investigation Guide",
    "Rule Type: ES|QL",
    "Tactic: Exfiltration",
    "Mitre Atlas: AML.T0025",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-anthropic.audit-*
| where
    data_stream.dataset == "anthropic.audit" and
    event.action == "claude_file_uploaded" and
    event.outcome == "success" and
    user.email is not null and
    source.ip is not null
| stats
    Esql.event_count = count(*),
    Esql.event_id_values = values(event.id),
    Esql.file_name_values = values(file.name),
    Esql.anthropic_audit_claude_file_id_values = values(anthropic.audit.claude_file_id),
    Esql.anthropic_audit_claude_chat_id_values = values(anthropic.audit.claude_chat_id),
    Esql.anthropic_audit_claude_project_id_values = values(anthropic.audit.claude_project_id),
    Esql.user_agent_original_values = values(user_agent.original),
    Esql.anthropic_audit_actor_type_values = values(anthropic.audit.actor.type),
    Esql.timestamp_first_seen = min(@timestamp),
    Esql.timestamp_last_seen = max(@timestamp)
  by user.email, source.ip
| where Esql.event_count >= 100
| keep user.email, source.ip, Esql.*
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1567"
name = "Exfiltration Over Web Service"
reference = "https://attack.mitre.org/techniques/T1567/"


[rule.threat.tactic]
id = "TA0010"
name = "Exfiltration"
reference = "https://attack.mitre.org/tactics/TA0010/"
[[rule.threat_mappings]]
framework = "MITRE ATLAS"
version = "2026.08"
[[rule.threat_mappings.threat]]
framework = "MITRE ATLAS"
[[rule.threat_mappings.threat.technique]]
id = "AML.T0025"
name = "Exfiltration via Cyber Means"
reference = "https://atlas.mitre.org/techniques/AML.T0025/"


[rule.threat_mappings.threat.tactic]
id = "AML.TA0010"
name = "Exfiltration"
reference = "https://atlas.mitre.org/tactics/AML.TA0010/"

[rule.alert_suppression]
group_by = ["user.email", "source.ip"]
missing_fields_strategy = "suppress"

[rule.investigation_fields]
field_names = [
    "user.email",
    "source.ip",
    "Esql.event_count",
    "Esql.event_id_values",
    "Esql.file_name_values",
    "Esql.anthropic_audit_claude_file_id_values",
    "Esql.anthropic_audit_claude_chat_id_values",
    "Esql.anthropic_audit_claude_project_id_values",
    "Esql.user_agent_original_values",
    "Esql.anthropic_audit_actor_type_values",
    "Esql.timestamp_first_seen",
    "Esql.timestamp_last_seen",
]

[rule.alert_suppression.duration]
unit = "h"
value = 24