Detection rules › Panther

Anthropic Primary Owner Transferred

Severity
high
Group by
actor.email_address
Log types
Anthropic.Activity
Tags
Anthropic, Privilege Escalation
Source
github.com/panther-labs/panther-analysis

Detects when the primary owner role of the Anthropic organization is transferred to another member. This is an extremely high-privilege action that gives full control of the organization. The previous_owner_id and new_owner_id fields identify who gave up and received ownership.

MITRE ATT&CK coverage

Rule body yaml

AnalysisType: rule
RuleID: Anthropic.Activity.Primary.Owner.Transferred
DisplayName: "Anthropic Primary Owner Transferred"
Enabled: true
Filename: anthropic_primary_owner_transferred.py
LogTypes:
  - Anthropic.Activity
Severity: High
Description: >
  Detects when the primary owner role of the Anthropic organization is
  transferred to another member. This is an extremely high-privilege action
  that gives full control of the organization. The previous_owner_id and
  new_owner_id fields identify who gave up and received ownership.
Runbook: |
  1. Find all Anthropic.Activity events by actor:email_address in the 24 hours before the alert to identify any suspicious activity leading up to the ownership transfer
  2. Check if actor:ip_address matches previously seen IP addresses for this actor in the past 30 days to detect potential account compromise
  3. Find all alerts for actor:email_address in the past 7 days to check for signs of account compromise preceding this action
Tags:
  - Anthropic
  - Privilege Escalation
Reports:
  MITRE ATT&CK:
    - TA0003:T1098.003  # Account Manipulation: Additional Cloud Roles
Tests:
  - Name: Primary owner transferred
    ExpectedResult: true
    Log:
      {
        "id": "activity_01ABC123",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "primary_owner_transferred",
        "actor": {
          "type": "user_actor",
          "email_address": "owner@example.com",
          "user_id": "user_01ABC",
          "ip_address": "10.0.0.1",
          "user_agent": "Mozilla/5.0"
        }
      }
  - Name: Non-matching event type
    ExpectedResult: false
    Log:
      {
        "id": "activity_01DEF456",
        "created_at": "2026-05-07T10:00:00Z",
        "organization_id": "org_01XYZ",
        "type": "role_assignment_granted",
        "actor": {
          "type": "user_actor",
          "email_address": "admin@example.com",
          "user_id": "user_01DEF",
          "ip_address": "10.0.0.2"
        }
      }

Detection logic

Condition

type eq "primary_owner_transferred"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
typeeq
  • primary_owner_transferred

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
event_typetype
actor_typeactor.type
actor_emailactor.email_address
actor_user_idactor.user_id
ip_addressactor.ip_address
user_agentactor.user_agent
api_key_idactor.api_key_id
organization_id
ipsp_any_ip_addresses