This detection rule monitors Anthropic audit logs for an event.category containing iam and event.action == 'primary_owner_transferred' with outcome == 'success'. It flags transfers of the 'primary ownership'—Anthropic's highest org authority responsible for billing, membership, and org-wide settings. Such transfers are rare and can be used by an attacker after privilege escalation to lock out legitimate administrators from recovery paths. The rule relies on anthropic.audit.previous_owner_id and anthropic.audit.new_owner_id to identify the transfer, and uses actor fields to identify the initiator. Investigation guidance covers pre-transfer indicators (e.g., claude_user_role_updated with current_role: admin, invite acceptances, or admin API key creation for the new owner) and post-transfer activity (SSO changes, exports, compliance logging disablement, or IP restriction deletions by the new owner). False positives include reorganizations or administrator departures; require corroboration with change-management or HR records. Remediation for unauthorized transfers includes engaging Anthropic support, revoking the new owner’s sessions/keys, and reviewing all admin changes performed under the new owner. The rule maps to MITRE ATT&CK technique T1098 (Account Manipulation) with subtechnique T1098.003 (Additional Cloud Roles) under tactic Privilege Escalation. References: platform.claude.com API/compliance activities endpoint. Threat context emphasizes privilege escalation and potential governance bypass.