LoFP / it and identity teams verify or add corporate domains during tenant onboarding, mergers, or dns migrations. confirm the domain and actor against change management records.

Techniques

• T1098

Sample rules

Anthropic Organization Domain Boundary Changed

• source: elastic
• technicques:
  • T1098

Description

Verified organization domains control which email addresses can join or be pulled into an Anthropic tenant. Verifying, claiming, adding, or removing a domain changes the tenant boundary and can pull in attacker-controlled mailboxes or push out legitimate corporate domains. These events are infrequent and affect organization-wide membership trust.

Detection logic

from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action in (
        "org_domain_verified",
        "org_domain_removed",
        "org_domain_add_initiated",
        "domain_claim_initiated"
    )
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*