Anthropic Primary Owner Transferred

Primary ownership is the highest administrative authority in an Anthropic organization, covering billing, membership, and organization-wide settings. Transferring ownership to an attacker-controlled account can lock out the legitimate administrator from recovery paths that depend on the original owner. Attackers often do this after role escalation so defenders cannot reverse earlier privilege changes through normal administration.

Rule type: esql
Rule indices:

Rule Severity: high
Risk Score: 73
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: GenAI
  • Platform: Anthropic
  • Data Source: Anthropic Audit Logs
  • Use Case: Identity and Access Audit
  • Use Case: Threat Detection
  • Resources: Investigation Guide
  • Rule Type: ES|QL
  • Tactic: Privilege Escalation
  • Mitre Atlas: AML.T0012

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2

Primary ownership is the highest Anthropic org authority (billing, membership, org-wide settings). Transfers should be rare and ticketed. Actor fields identify who initiated the transfer — not the new owner (anthropic.audit.previous_owner_id / new_owner_id).

Unauthorized = no HR/IT offboarding or ownership-change ticket naming both parties, or the new owner was recently invited / granted admin and immediately received ownership, especially with follow-on SSO/key/export changes.

  • Map anthropic.audit.previous_owner_id → new_owner_id and resolve initiator (actor.type; for user_actor check email/IP/UA).
  • Before the transfer: look for claude_user_role_updated with anthropic.audit.current_role: admin, invite accept, or admin API key creation for the new owner path.
  • After the transfer: look for SSO changes, exports, compliance logging disablement, or IP restriction deletes by the new owner.
  • Contact previous and new owners only after ticket/timeline triage; escalate when ticket is missing or the new owner chain looks staged.
  • Reorgs and admin departures are valid — require matching change management / HR records.
  • On unauthorized transfer: engage Anthropic support and internal IT to recover ownership, revoke the new owner's sessions/keys, and review every admin change made under the new owner account.
from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "primary_owner_transferred" and
    event.outcome == "success"
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*

Framework: MITRE ATT&CK