--- title: Anthropic Activity from a Suspicious User Agent description: Detects successful Anthropic audit activity where the user agent matches scripting HTTP clients, offensive scanners, or automation libraries (for example... url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/anthropic/command_and_control_anthropic_suspicious_user_agent products: - Elastic Security --- # Anthropic Activity from a Suspicious User Agent Detects successful Anthropic audit activity where the user agent matches scripting HTTP clients, offensive scanners, or automation libraries (for example curl, python-requests, Go-http-client, axios, nuclei). Browser and first-party Claude clients normally present recognizable browser or product user agents; raw HTTP library agents on successful control-plane or product activity often indicate scripted access, stolen-session reuse, or unauthorized automation. Known benign automation patterns (axios or Go HTTP clients on file upload/delete, trusted device enrollment, and environment creation) are excluded. **Rule type**: esql **Rule indices**: **Rule Severity**: medium **Risk Score**: 47 **Runs every**: **Searches indices from**: `now-9m` **Maximum alerts per execution**: 100 **References**: - [[https://platform.claude.com/docs/en/api/compliance/activities/list](https://platform.claude.com/docs/en/api/compliance/activities/list)](https://platform.claude.com/docs/en/api/compliance/activities/list) **Tags**: - Domain: GenAI - Platform: Anthropic - Data Source: Anthropic Audit Logs - Use Case: Threat Detection - Resources: Investigation Guide - Rule Type: ES|QL - Tactic: Command and Control - Mitre Atlas: AML.T0012 **Version**: 1 **Rule authors**: - Elastic **Rule license**: Elastic License v2 ## Investigation guide ## Triage and analysis ### Investigating Anthropic Activity from a Suspicious User Agent Successful Anthropic audit events normally come from browser or first-party Claude clients. This rule flags scripting HTTP clients, scanners, or automation libraries on successful activity. UAs are spoofable — corroborate with actor, IP, and `event.action`. Benign automation using axios or Go HTTP clients is already excluded for `platform_file_uploaded`, `platform_file_deleted`, `claude_file_uploaded`, `trusted_device_enrolled`, and `environment_created`. Unauthorized / escalate when a normally browser-bound user suddenly uses curl/python/Go-http-client on privileged actions (IAM, exports, SSO, keys). Close as FP for approved SDK/CI identities on expected actions. #### Possible investigation steps - Compare `user_agent.original` and `event.action` to the user's baseline. A shift to curl, python-requests, or Go-http-client on admin/export actions is higher priority than the same UA on already-allowlisted file ops. - Branch `anthropic.audit.actor.type` and check `user.email` / `source.ip` against approved automation inventory. - Pivot the same email/IP for auth failures, impossible travel, role changes, exports, or compliance logging changes. ### False positive analysis - Internal GenAI SDKs (`openai*`, `anthropic-sdk*`, `langchain*`) and CI jobs match — exclude stable identities, not entire UA families. Extend the Go/axios action allowlist only with evidence of additional benign actions. ### Response and remediation - On unauthorized scripting access: revoke sessions, rotate credentials/MFA, review admin/export activity around the alert, and hunt other scripting-UA activity from the same IP or email. ## Rule Query ```esql from logs-anthropic.audit-* metadata _id, _version, _index | where data_stream.dataset == "anthropic.audit" and event.outcome == "success" and source.ip is not null and source.ip != "0.0.0.0" and user.email is not null and user_agent.original is not null | eval Esql.ua_lower = to_lower(user_agent.original) | where ( Esql.ua_lower like "curl*" or Esql.ua_lower like "python*" or Esql.ua_lower like "wget*" or Esql.ua_lower like "go-http*" or Esql.ua_lower like "perl*" or Esql.ua_lower like "libwww-perl*" or Esql.ua_lower like "java*" or Esql.ua_lower like "node*" or Esql.ua_lower like "php*" or Esql.ua_lower like "guzzle*" or Esql.ua_lower like "bun*" or Esql.ua_lower like "axios*" or Esql.ua_lower like "undici*" or Esql.ua_lower like "okhttp*" or Esql.ua_lower like "apache-httpclient*" or Esql.ua_lower like "httpclient*" or Esql.ua_lower like "httpie*" or Esql.ua_lower like "ruby*" or Esql.ua_lower like "postmanruntime*" or Esql.ua_lower like "restsharp*" or Esql.ua_lower like "*kali*" or Esql.ua_lower like "*parrot*" or Esql.ua_lower like "*pentoo*" or Esql.ua_lower like "*backbox*" or Esql.ua_lower like "*blackarch*" or Esql.ua_lower like "scrapy*" or Esql.ua_lower like "mechanize*" or Esql.ua_lower like "aiohttp*" or Esql.ua_lower like "httpx*" or Esql.ua_lower like "requests*" or Esql.ua_lower like "pycurl*" or Esql.ua_lower like "urllib*" or Esql.ua_lower like "got/*" or Esql.ua_lower like "node-fetch*" or Esql.ua_lower like "superagent*" or Esql.ua_lower like "ky/*" or Esql.ua_lower like "fetch*" or Esql.ua_lower like "deno*" or Esql.ua_lower like "powershell*" or Esql.ua_lower like "invoke-webrequest*" or Esql.ua_lower like "windowspowershell*" or Esql.ua_lower like "wget2*" or Esql.ua_lower like "aria2*" or Esql.ua_lower like "httrack*" or Esql.ua_lower like "nikto*" or Esql.ua_lower like "sqlmap*" or Esql.ua_lower like "nmap*" or Esql.ua_lower like "masscan*" or Esql.ua_lower like "zgrab*" or Esql.ua_lower like "nuclei*" or Esql.ua_lower like "dirbuster*" or Esql.ua_lower like "gobuster*" or Esql.ua_lower like "ffuf*" or Esql.ua_lower like "feroxbuster*" or Esql.ua_lower like "wfuzz*" or Esql.ua_lower like "burpsuite*" or Esql.ua_lower like "hydra*" or Esql.ua_lower like "metasploit*" or Esql.ua_lower like "*havoc*" or Esql.ua_lower like "*sliver*" or Esql.ua_lower like "*cobalt strike*" or Esql.ua_lower like "dart*" or Esql.ua_lower like "rector*" or Esql.ua_lower like "ruby-faraday*" or Esql.ua_lower like "httparty*" or Esql.ua_lower like "clj-http*" or Esql.ua_lower like "hackney*" or Esql.ua_lower like "elixir*" or Esql.ua_lower like "swift-nio*" or Esql.ua_lower like "vapor*" or Esql.ua_lower like "rust*" or Esql.ua_lower like "reqwest*" or Esql.ua_lower like "ureq*" or Esql.ua_lower like "hyper/*" or Esql.ua_lower like "cohere-go*" or Esql.ua_lower like "openai*" or Esql.ua_lower like "anthropic-sdk*" or Esql.ua_lower like "langchain*" or Esql.ua_lower like "llamaindex*" or Esql.ua_lower like "litellm*" or Esql.ua_lower like "dspy*" or Esql.ua_lower like "*zgrab*" or Esql.ua_lower like "*masscan*" or Esql.ua_lower like "*nessus*" or Esql.ua_lower like "*shodan*" or Esql.ua_lower like "*censys*" or Esql.ua_lower like "*binaryedge*" or Esql.ua_lower like "*internetmeasurement*" or Esql.ua_lower like "*internetcensus*" or Esql.ua_lower like "*shadowserver*" or Esql.ua_lower like "*stretchoid*" or Esql.ua_lower like "*http.rb*" ) and not ( event.action in ( "platform_file_deleted", "platform_file_uploaded", "claude_file_uploaded", "trusted_device_enrolled", "environment_created" ) and (Esql.ua_lower like "go-http*" or Esql.ua_lower like "axios*") ) | keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*, Esql.ua_lower ``` **Framework:** MITRE ATT&CK - Tactic: - Name: Command and Control - Id: TA0011 - Reference URL: [[https://attack.mitre.org/tactics/TA0011/](https://attack.mitre.org/tactics/TA0011/)](https://attack.mitre.org/tactics/TA0011/) - Technique: - Name: Application Layer Protocol - Id: T1071 - Reference URL: [[https://attack.mitre.org/techniques/T1071/](https://attack.mitre.org/techniques/T1071/)](https://attack.mitre.org/techniques/T1071/) - Sub Technique: - Name: Web Protocols - Id: T1071.001 - Reference URL: [[https://attack.mitre.org/techniques/T1071/001/](https://attack.mitre.org/techniques/T1071/001/)](https://attack.mitre.org/techniques/T1071/001/)