Elastic medium stable eql

Claude Cowork VM Boot Image Tamper

Detects unexpected modification of Claude Desktop Cowork VM boot images (kernel, initrd, root filesystem). Adversaries with user-context access can rewrite these stored images so later Cowork sessions boot attacker-controlled code inside a virtual instance that host EDR cannot inspect by default.

View Source

Detection Logic

file where host.os.type in ("windows", "macos") and
  event.action in ("creation", "modification", "overwrite", "rename") and
  event.outcome == "success" and
  file.path : (
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/initrd.zst",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/vmlinuz.zst",
    "/Users/*/Library/Application Support/Claude/vm_bundles/claudevm.bundle/rootfs.img",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\initrd.zst",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\vmlinuz",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\rootfs.vhdx",
    "?:\\Users\\*\\AppData\\Local\\Packages\\Claude_*\\LocalCache\\Roaming\\Claude\\vm_bundles\\claudevm.bundle\\smol-bin.vhdx"
  ) and
  not (
    (process.name : "claude.exe" and
     process.executable : "?:\\Program Files\\WindowsApps\\Claude_*\\app\\claude.exe") or
    (process.name : ("Claude", "Claude Helper") and
     process.executable like "/Applications/Claude.app/*")
  )

Field Validations

Loading…

Comments (0)

Loading comments...