Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1098-account-manipulation

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects when a new Anthropic Admin API key is created.

Strategy

This rule monitors Anthropic Compliance activities for api_key_created events that carry a scopes array (the field that distinguishes Admin API keys from Claude inference keys). Admin API keys authenticate Admin API requests for managing users, invites, workspaces, and platform API keys, and authenticate Activity Feed requests with the read:compliance_activities scope when the Compliance API is enabled. They are intrinsically higher-privilege than ordinary Claude (platform) API keys, so creation warrants Medium severity even with no other context. Note: the parallel platform_api_key_created event covers Claude inference keys, does not carry scopes, and is intentionally out of scope here.

Triage and response

• Confirm {{@usr.email}} is an organization admin authorized to create Admin API keys.
• Inspect the granted @scopes array for unexpected privileges.
• Examine the actor’s recent authentication and privilege-change history for compromise indicators.
• Verify the documented intended use of the key (CI automation, internal tooling) and that it is stored in a secrets manager.
• If the action was unauthorized, revoke it via the Compliance console and audit any Admin API actions taken with the key.