Detects Base64 variations of redacted thinking magic string that cause Claude sessions to be terminated. This might indi

Hunt Hypothesis

This hunt targets adversaries attempting to evade Large Language Model (LLM) analysis by injecting specific Base64 variations of redacted thinking magic strings that forcibly terminate Claude sessions. Proactively hunting for this behavior in Azure Sentinel is critical because it reveals sophisticated file-based obfuscation tactics designed to disrupt automated threat intelligence and prevent deep inspection of suspicious artifacts.

YARA Rule

rule SUSP_Claude_Redacted_Thinking_Magic_String_Jan26_2 {
   meta:
      description = "Detects Base64 variations of redacted thinking magic string that cause Claude sessions to be terminated. This might indicate that a file tries to prevent being analyzed by LLM agents."
      author = "Marius Benthin"
      date = "2026-01-29"
      reference = "Internal Research"
      score = 75
      id = "453ad61a-838f-529a-b119-1dd3ec559069"
   strings:
      $xb1 = "ANTHROPIC_MAGIC_STRING_TRIGGER_REDACTED_THINKING_" ascii wide base64 base64wide
   condition:
      $xb1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• Internal Research
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the rule “Detects Base64 variations of redacted thinking magic string that cause Claude sessions to be terminated,” along with suggested filters and exclusions:

• Scenario: Automated Backup Encryption Jobs

  • Context: Scheduled backup agents (e.g., Veeam, Rubrik, or Commvault) often encrypt large log files or database dumps using Base64 encoding before transmission. These encrypted payloads frequently contain binary patterns that mimic the “redacted thinking magic string” signature, triggering session terminations when LLM agents attempt to scan them during peak backup windows.
  • Filter/Exclusion: Exclude traffic originating from known backup service accounts (e.g., svc-veeam-backup, admin-rubrik) and filter out events occurring on the specific backup schedule window (e.g., 02:00–04:00 UTC) where file sizes exceed 50MB.

• Scenario: CI/CD Pipeline Artifact Generation

  • Context: Continuous Integration tools like Jenkins, GitLab CI, or GitHub Actions generate temporary artifacts and Docker images during build processes. These pipelines often embed Base64-encoded metadata strings (including “thinking” headers for traceability) into container layers, which can be misidentified as an attempt to block LLM analysis when the pipeline pushes to a registry.
  • Filter/Exclusion: Create an exclusion list for source IPs belonging to the CI/CD cluster and filter events where the process name matches known build runners (e.g., jenkins-agent-01, gitlab-runner). Additionally, exclude files with extensions .tar.gz or .docker-image which are known carriers of these strings.

• Scenario: Cloud Security Posture Management Scans

  • Context: Cloud security tools such as **