LoFP / finance or platform teams delete outdated spend limits when consolidating billing policies or replacing them with new limits. confirm the actor, nearby create or update events, and an approved change before escalating.

Techniques

• T1496

Sample rules

Anthropic Extra Usage Spend Limit Deleted

• source: elastic
• technicques:
  • T1496

Description

Extra usage spend limits cap Anthropic organizational spend beyond included usage. Deleting a spend limit removes that cap and can enable unrestricted API or Claude consumption. An attacker who already has administrative or API access can delete the limit to burn budget, run large automated workloads, or stage resource abuse without the previous guardrail.

Detection logic

from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "extra_usage_spend_limit_deleted"
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*