Detects redacted thinking magic string that cause Claude sessions to be terminated. This might indicate that a file trie

Hunt Hypothesis

This hunt targets adversaries who inject specific “redacted thinking” magic strings into files to trigger premature termination of Claude LLM sessions, thereby evading automated analysis and obscuring malicious content. A proactive search is essential in Azure Sentinel because this behavior suggests a sophisticated file-based evasion tactic that could allow attackers to bypass standard AI-driven threat detection pipelines undetected.

YARA Rule

rule SUSP_Claude_Redacted_Thinking_Magic_String_Jan26_1 {
   meta:
      description = "Detects redacted thinking magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents."
      author = "Marius Benthin"
      date = "2026-01-29"
      reference = "Internal Research"
      hash = "ffa48ed4b7b48897f6756c4222b2606399de0bca627cedfddf61e69986580430"
      score = 65
      id = "623de3f9-ea03-5b6a-bb24-14b4a6d4a7c9"
   strings:
      $x1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REDACTED_THINKING_" ascii wide nocase
   condition:
      $x1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the rule detecting redacted thinking magic strings in an enterprise environment, along with suggested filters or exclusions:

• Scenario: Scheduled Backup of LLM Agent Logs

  • Context: The nightly backup job using Veeam Backup & Replication archives the /var/log/claude-agent directory. During the archiving process, the backup agent reads the thinking_magic_string file headers to verify integrity before compression, triggering a session termination event that mimics an evasion attempt.
  • Filter/Exclusion: Exclude processes running under the service account svc-veeam-backup and specifically target file paths matching *.log or *.tar.gz extensions within the backup directory.

• Scenario: Automated Compliance Scanning by Microsoft Defender

  • Context: Microsoft Defender for Cloud Apps performs a scheduled on-demand scan of the shared network drive where LLM agents store temporary context files. The scanner’s heuristic engine reads the magic string to classify file types, causing the rule to interpret this read operation as an attempt to block analysis.
  • Filter/Exclusion: Create an exclusion for the process MsMpEng.exe (Microsoft Defender Antivirus) when it accesses files within the \\EnterpriseShare\LLMContext network path during business hours (08:00–18:00).

• Scenario: CI/CD Pipeline Artifact Processing

  • Context: The Jenkins pipeline executes a post-build stage where it ingests generated documentation files containing the magic string to update the artifact repository. The file I/O operation performed by the Jenkins agent (java process) triggers the detection logic as if an external entity is preventing analysis.
  • Filter/Exclusion: Exclude events originating from hostnames matching jenkins-build-node-* and restrict