Detection rules › Panther
Anthropic MCP Server Deleted
Detects when an MCP server integration is deleted from the organization. Removing an approved integration could indicate an attacker covering tracks or unauthorized configuration changes. The mcp_server_name and mcp_server_id fields identify which integration was removed.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1562 Impair Defenses |
Rule body yaml
AnalysisType: rule
RuleID: Anthropic.Activity.MCP.Server.Deleted
DisplayName: "Anthropic MCP Server Deleted"
Enabled: true
Filename: anthropic_mcp_server_deleted.py
LogTypes:
- Anthropic.Activity
Severity: Low
Description: >
Detects when an MCP server integration is deleted from the organization.
Removing an approved integration could indicate an attacker covering tracks
or unauthorized configuration changes. The mcp_server_name and mcp_server_id
fields identify which integration was removed.
Runbook: |
1. Find all Anthropic.Activity events with type mcp_server_created by actor:email_address in the 10 minutes after the alert to determine if this was a delete-then-recreate (config fix) or a standalone deletion
2. Check if actor:email_address has performed other administrative actions (claude_organization_settings_updated, mcp_server_created) in the 6 hours around the alert to assess if this is part of routine admin work
3. Find all alerts for actor:email_address in the past 7 days to check for signs of account compromise preceding this action
Tags:
- Anthropic
- Configuration
Reports:
MITRE ATT&CK:
- TA0005:T1562 # Impair Defenses
Tests:
- Name: MCP server deleted
ExpectedResult: true
Log:
{
"id": "activity_01ABC123",
"created_at": "2026-05-05T21:46:28Z",
"organization_id": "org_01XYZ",
"type": "mcp_server_deleted",
"mcp_server_id": "mcpsrv_01ABC",
"mcp_server_name": "Snowflake",
"actor": {
"type": "user_actor",
"email_address": "admin@example.com",
"user_id": "user_01ABC",
"ip_address": "10.0.0.1",
"user_agent": "Mozilla/5.0"
}
}
- Name: MCP server created - not a match
ExpectedResult: false
Log:
{
"id": "activity_01DEF456",
"created_at": "2026-05-05T21:52:51Z",
"organization_id": "org_01XYZ",
"type": "mcp_server_created",
"mcp_server_id": "mcpsrv_01DEF",
"mcp_server_name": "Snowflake",
"actor": {
"type": "user_actor",
"email_address": "admin@example.com",
"user_id": "user_01ABC",
"ip_address": "10.0.0.1"
}
}
Detection logic
Condition
type eq "mcp_server_deleted"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
type | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
event_type | type |
actor_type | actor.type |
actor_email | actor.email_address |
actor_user_id | actor.user_id |
ip_address | actor.ip_address |
user_agent | actor.user_agent |
api_key_id | actor.api_key_id |
organization_id | |
ips | p_any_ip_addresses |
mcp_server_name |