Elastic Security Detection Rules

Anthropic Extra Usage Spend Limit Deleted

Last updated 4 days ago on 2026-09-21
Created 9 days ago on 2026-09-16

About

Extra usage spend limits cap Anthropic organizational spend beyond included usage. Deleting a spend limit removes that cap and can enable unrestricted API or Claude consumption. An attacker who already has administrative or API access can delete the limit to burn budget, run large automated workloads, or stage resource abuse without the previous guardrail.
Tags
Domain: GenAIPlatform: AnthropicData Source: Anthropic Audit LogsUse Case: Threat DetectionRule Type: ES|QLTactic: ImpactLanguage: esql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Resource Hijacking (T1496)(external, opens in a new tab or window)

False Positive Examples
Finance or platform teams delete outdated spend limits when consolidating billing policies or replacing them with new limits. Confirm the actor, nearby create or update events, and an approved change before escalating.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

anthropic(external, opens in a new tab or window)

Query
text code block:
from logs-anthropic.audit-* metadata _id, _version, _index
| where
    data_stream.dataset == "anthropic.audit" and
    mv_contains(event.category, "configuration") and
    event.action == "extra_usage_spend_limit_deleted"
| keep _id, _version, _index, @timestamp, event.*, organization.*, user.*, source.*, user_agent.*, anthropic.audit.*, data_stream.*

Install detection rules in Elastic Security

Detect Anthropic Extra Usage Spend Limit Deleted in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).