Detects Base64 variations of refusal magic string that cause Claude sessions to be terminated. This might indicate that

Hunt Hypothesis

This detection identifies adversary attempts to disrupt AI-driven security operations by injecting malformed Base64-encoded refusal strings that forcibly terminate Claude sessions, potentially signaling a targeted denial-of-service or session hijacking attack. Proactively hunting for this behavior in Azure Sentinel is critical because these specific termination patterns can mask lateral movement or data exfiltration activities within cloud-native AI workflows before they escalate into broader service outages.

YARA Rule

rule MAL_Claude_Refusal_Magic_String_Jan26 {
   meta:
      description = "Detects Base64 variations of refusal magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents."
      author = "Marius Benthin"
      date = "2026-01-29"
      reference = "Internal Research"
      score = 80
      id = "8f0351b7-56b8-5059-8c1e-e8d87fa0ca91"
   strings:
      $xb1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REFUSAL_" ascii wide base64 base64wide
   condition:
      $xb1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

Internal Research
Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule detecting Base64 variations of refusal magic strings in Claude sessions, along with suggested filters or exclusions:

Scenario: Automated CI/CD pipelines using GitHub Actions or Jenkins trigger a “refusal” response when validating large payload schemas during nightly builds. The build agents often encode error messages containing the refusal string into Base64 before logging them to the SIEM, mimicking a session termination event.
- Suggested Filter: Exclude events where the source_host matches known CI/CD runner subnets (e.g., 10.20.15.0/24) and the process_name is github-runner or jenkins-agent.
Scenario: Enterprise Document Management Systems (such as SharePoint Online or M-Files) perform scheduled nightly indexing jobs that parse PDF attachments containing embedded metadata. When these systems encounter a malformed attachment, they generate a Base64-encoded refusal string to flag the document for manual review, which triggers this rule.
- Suggested Filter: Create an exclusion based on scheduled_task_name equal to “NightlyIndexingJob” and filter out events where the file_extension is .pdf or .docx.
Scenario: The IT Operations team utilizes a custom Python script (running via cron) to audit user session logs for compliance reporting. This script iterates through archived sessions, re-encoding specific “refusal” status codes into Base64 format before writing them to the central log repository, causing a spike in detections during business hours.
- Suggested Filter: Exclude events where the user_agent contains “Python-requests/2.x” and the event_type is marked as “Scheduled_Audit”.
Scenario: Third-party API Gateway tools (like Apigee or Kong) configured to handle rate limiting often