This rule detects successful organization user invites in Anthropic audit logs (org_user_invite_sent) as a potential persistence mechanism. An attacker who compromises an administrator or admin API key could invite a mailbox they control and, upon acceptance, gain durable access. Invites may target internal corporate or external domains; the rule does not rely on verified domain lists because invite events do not carry trusted domain data. The detection uses a Cloud/Application logging perspective and maps to MITRE ATT&CK Persistence (T1136: Create Account; T1136.003: Cloud Account). The query runs against logs-anthropic.audit*, filtering for event.category containing iam, action org_user_invite_sent, and outcome of success, and returns key fields including invite details, actor, recipient, and related entities for investigation. The rule includes investigation guidance to triage external invite domains, differentiate actor types (user_actor vs admin_api_key_actor), and correlate with org_user_invite_accepted, role grants, SSO changes, or admin API key activity. False positives include routine onboarding or HR/IT tickets that name invitees and roles. Remediation emphasizes revoking unauthorized invites, verifying any related IAM changes, and rotating compromised credentials or API keys. The rule is intended for threat detection and incident response workflows, with a medium severity and a risk score of 47.**