LoFP LoFP / approved internal automation, ci jobs, or sdk integrations may present scripting user agents. validate the actor, source ip, and action against change tickets before treating as compromise. prefer excluding stable identities or source networks rather than removing the matching user-agent pattern.

Techniques

Sample rules

Anthropic Activity from a Suspicious User Agent

Description

Detects successful Anthropic audit activity where the user agent matches scripting HTTP clients, offensive scanners, or automation libraries (for example curl, python-requests, Go-http-client, axios, nuclei). Browser and first-party Claude clients normally present recognizable browser or product user agents; raw HTTP library agents on successful control-plane or product activity often indicate scripted access, stolen-session reuse, or unauthorized automation. Known benign automation patterns (axios or Go HTTP clients on file upload/delete, trusted device enrollment, and environment creation) are excluded.

Detection logic

from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    event.outcome == "success" and
    source.ip is not null and
    source.ip != "0.0.0.0" and
    user.email is not null and
    user_agent.original is not null
| eval Esql.ua_lower = to_lower(user_agent.original)
| where
    (
        Esql.ua_lower like "curl*" or
        Esql.ua_lower like "python*" or
        Esql.ua_lower like "wget*" or
        Esql.ua_lower like "go-http*" or
        Esql.ua_lower like "perl*" or
        Esql.ua_lower like "libwww-perl*" or
        Esql.ua_lower like "java*" or
        Esql.ua_lower like "node*" or
        Esql.ua_lower like "php*" or
        Esql.ua_lower like "guzzle*" or
        Esql.ua_lower like "bun*" or
        Esql.ua_lower like "axios*" or
        Esql.ua_lower like "undici*" or
        Esql.ua_lower like "okhttp*" or
        Esql.ua_lower like "apache-httpclient*" or
        Esql.ua_lower like "httpclient*" or
        Esql.ua_lower like "httpie*" or
        Esql.ua_lower like "ruby*" or
        Esql.ua_lower like "postmanruntime*" or
        Esql.ua_lower like "restsharp*" or
        Esql.ua_lower like "*kali*" or
        Esql.ua_lower like "*parrot*" or
        Esql.ua_lower like "*pentoo*" or
        Esql.ua_lower like "*backbox*" or
        Esql.ua_lower like "*blackarch*" or
        Esql.ua_lower like "scrapy*" or
        Esql.ua_lower like "mechanize*" or
        Esql.ua_lower like "aiohttp*" or
        Esql.ua_lower like "httpx*" or
        Esql.ua_lower like "requests*" or
        Esql.ua_lower like "pycurl*" or
        Esql.ua_lower like "urllib*" or
        Esql.ua_lower like "got/*" or
        Esql.ua_lower like "node-fetch*" or
        Esql.ua_lower like "superagent*" or
        Esql.ua_lower like "ky/*" or
        Esql.ua_lower like "fetch*" or
        Esql.ua_lower like "deno*" or
        Esql.ua_lower like "powershell*" or
        Esql.ua_lower like "invoke-webrequest*" or
        Esql.ua_lower like "windowspowershell*" or
        Esql.ua_lower like "wget2*" or
        Esql.ua_lower like "aria2*" or
        Esql.ua_lower like "httrack*" or
        Esql.ua_lower like "nikto*" or
        Esql.ua_lower like "sqlmap*" or
        Esql.ua_lower like "nmap*" or
        Esql.ua_lower like "masscan*" or
        Esql.ua_lower like "zgrab*" or
        Esql.ua_lower like "nuclei*" or
        Esql.ua_lower like "dirbuster*" or
        Esql.ua_lower like "gobuster*" or
        Esql.ua_lower like "ffuf*" or
        Esql.ua_lower like "feroxbuster*" or
        Esql.ua_lower like "wfuzz*" or
        Esql.ua_lower like "burpsuite*" or
        Esql.ua_lower like "hydra*" or
        Esql.ua_lower like "metasploit*" or
        Esql.ua_lower like "*havoc*" or
        Esql.ua_lower like "*sliver*" or
        Esql.ua_lower like "*cobalt strike*" or
        Esql.ua_lower like "dart*" or
        Esql.ua_lower like "rector*" or
        Esql.ua_lower like "ruby-faraday*" or
        Esql.ua_lower like "httparty*" or
        Esql.ua_lower like "clj-http*" or
        Esql.ua_lower like "hackney*" or
        Esql.ua_lower like "elixir*" or
        Esql.ua_lower like "swift-nio*" or
        Esql.ua_lower like "vapor*" or
        Esql.ua_lower like "rust*" or
        Esql.ua_lower like "reqwest*" or
        Esql.ua_lower like "ureq*" or
        Esql.ua_lower like "hyper/*" or
        Esql.ua_lower like "cohere-go*" or
        Esql.ua_lower like "openai*" or
        Esql.ua_lower like "anthropic-sdk*" or
        Esql.ua_lower like "langchain*" or
        Esql.ua_lower like "llamaindex*" or
        Esql.ua_lower like "litellm*" or
        Esql.ua_lower like "dspy*" or
        Esql.ua_lower like "*zgrab*" or
        Esql.ua_lower like "*masscan*" or
        Esql.ua_lower like "*nessus*" or
        Esql.ua_lower like "*shodan*" or
        Esql.ua_lower like "*censys*" or
        Esql.ua_lower like "*binaryedge*" or
        Esql.ua_lower like "*internetmeasurement*" or
        Esql.ua_lower like "*internetcensus*" or
        Esql.ua_lower like "*shadowserver*" or
        Esql.ua_lower like "*stretchoid*" or
        Esql.ua_lower like "*http.rb*"
    ) and
    not (
        event.action in (
            "platform_file_deleted",
            "platform_file_uploaded",
            "claude_file_uploaded",
            "trusted_device_enrolled",
            "environment_created"
        ) and
        (Esql.ua_lower like "go-http*" or Esql.ua_lower like "axios*")
    )
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*, Esql.ua_lower