Detection rules › Panther
Anthropic Admin API Key Deleted
Detects when an admin API key is deleted. Unauthorized deletion could indicate an attacker revoking legitimate credentials to disrupt operations or covering tracks after using a compromised key.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098.001 Account Manipulation: Additional Cloud Credentials |
| Privilege Escalation | T1098.001 Account Manipulation: Additional Cloud Credentials |
Rule body yaml
AnalysisType: rule
RuleID: Anthropic.Activity.Admin.API.Key.Deleted
DisplayName: "Anthropic Admin API Key Deleted"
Enabled: true
Filename: anthropic_admin_api_key_deleted.py
LogTypes:
- Anthropic.Activity
Severity: Medium
Description: >
Detects when an admin API key is deleted. Unauthorized deletion could
indicate an attacker revoking legitimate credentials to disrupt operations
or covering tracks after using a compromised key.
Runbook: |
1. Find all Anthropic.Activity events by actor:email_address in the 6 hours before and after the alert to determine if this is part of routine key rotation
2. Check if an admin_api_key_created event occurred near this deletion to determine if this is a key rotation or a standalone deletion
3. Check if actor:ip_address is associated with known VPN/proxy services or matches previously seen IP addresses for this actor
Tags:
- Anthropic
- Credential Access
Reports:
MITRE ATT&CK:
- TA0006:T1098.001 # Account Manipulation: Additional Cloud Credentials
Tests:
- Name: Admin API key deleted
ExpectedResult: true
Log:
{
"id": "activity_01ABC123",
"created_at": "2026-05-07T10:00:00Z",
"organization_id": "org_01XYZ",
"type": "admin_api_key_deleted",
"actor": {
"type": "user_actor",
"email_address": "admin@example.com",
"user_id": "user_01ABC",
"ip_address": "10.0.0.1",
"user_agent": "Mozilla/5.0"
}
}
- Name: Non-matching event type
ExpectedResult: false
Log:
{
"id": "activity_01DEF456",
"created_at": "2026-05-07T10:00:00Z",
"organization_id": "org_01XYZ",
"type": "admin_api_key_created",
"actor": {
"type": "user_actor",
"email_address": "admin@example.com",
"user_id": "user_01ABC",
"ip_address": "10.0.0.1"
}
}
Detection logic
Condition
type eq "admin_api_key_deleted"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
type | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
event_type | type |
actor_type | actor.type |
actor_email | actor.email_address |
actor_user_id | actor.user_id |
ip_address | actor.ip_address |
user_agent | actor.user_agent |
api_key_id | actor.api_key_id |
organization_id | |
ips | p_any_ip_addresses |