Anthropic 'Claude Money' Banking Integration: Defending Financial Data in AI Assistant Pipelines

---
title: Non-Browser Process Connection to Anthropic API Endpoints
id: 3f8a1c74-2b6d-4e9a-a5c7-8d1e2f3a4b5c
status: experimental
description: Detects non-browser processes establishing network connections to Anthropic API infrastructure. Legitimate Claude usage occurs in a browser or sanctioned app; scripts, CLI tools, or unknown binaries talking to api.anthropic.com may indicate unsanctioned API integrations, automated data pipelines, or data exfiltration via AI services.
references:
  - https://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-wants-claude-to-analyze-your-bank-account-and-financial-data/
  - https://attack.mitre.org/techniques/T1567/002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'api.anthropic.com'
      - 'claude.ai'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\claude.exe'
  condition: selection_domain and not filter_browsers
falsepositives:
  - Sanctioned developer API usage for approved AI integrations
  - Approved Claude desktop/CLI tooling
level: medium
---
title: OAuth Consent Grant to AI or Financial Aggregation Application
id: 8c2d4e61-9f3a-4b78-b1c2-5e6f7a8b9c0d
status: experimental
description: Detects user consent grants to third-party OAuth applications in Microsoft Entra ID, focusing on high-risk permission scopes. Attackers and unsanctioned AI/fintech integrations both rely on user-driven consent to establish persistent data access. Review consent grants involving mail, file, or financial data scopes for unknown publishers.
references:
  - https://attack.mitre.org/techniques/T1550/001/
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1550.001
logsource:
  category: audit
  product: azure
detection:
  selection:
    OperationName:
      - 'Consent to application'
      - 'Add OAuth2PermissionGrant'
    RiskScopes|contains:
      - 'Mail.Read'
      - 'Files.Read.All'
      - 'Sites.Read.All'
      - 'offline_access'
  condition: selection
falsepositives:
  - Approved enterprise application onboarding
  - IT-administered consent grants for vetted vendors
level: high
---
title: Sensitive Financial Filename or Card Pattern Access Followed by AI Endpoint Connection
id: 5e9b2f48-7c1a-4d56-9e3f-2a4b6c8d0e1f
status: experimental
description: Detects processes accessing files with finance-related naming patterns (bank exports, card statements, reconciliation files) where the same process subsequently initiates outbound HTTPS connections. Correlating financial file access with non-standard egress helps surface users or scripts staging financial data for upload to unsanctioned AI services.
references:
  - https://attack.mitre.org/techniques/T1530/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1530
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - 'bank_statement'
      - 'card_transactions'
      - 'reconciliation'
      - 'plaid'
      - 'ofx'
      - '.qfx'
      - 'expense_export'
  filter_system:
    Image|endswith:
      - '\svchost.exe'
      - '\MsMpEng.exe'
  condition: selection and not filter_system
falsepositives:
  - Accounting software accessing legitimate exports
  - Finance team workflows with sanctioned tools
level: medium

// Hunt: Corporate endpoints communicating with AI platform APIs via non-browser processes
// Purpose: Surface unsanctioned AI integrations and potential financial data staging.
// Tune the sanctioned process list to your environment before production use.
let AiDomains = dynamic(["api.anthropic.com", "claude.ai", "api.openai.com", "generativelanguage.googleapis.com"]);
let Sanctioned = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "claude.exe", "Code.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (AiDomains)
| where not(FileName in~ (Sanctioned))
| extend RemoteHost = tostring(RemoteUrl)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    ConnectionCount = count(), DistinctRemoteIPs = dcount(RemoteIP),
    RemoteIPs = make_set(RemoteIP)
    by DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName
| order by ConnectionCount desc;

// Hunt: Entra ID OAuth consent grants to unverified/newly-seen applications
// Purpose: Catch user-driven consent grants that could bridge financial data sources to third-party AI/fintech apps.
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName in ("Consent to application", "Add OAuth2PermissionGrant")
| mv-apply Target = TargetResources on (
    mv-apply ModProp = Target.modifiedProperties on (
        where ModProp.displayName == "ConsentAction.Permissions"
    )
)
| extend AppDisplayName = tostring(TargetResources[0].displayName)
| extend InitiatedByUser = tostring(parse_json(InitiatedBy).user.userPrincipalName)
| project TimeGenerated, OperationName, AppDisplayName, InitiatedByUser,
    Result = Result, CorrelationId
| order by TimeGenerated desc;

// Hunt: Syslog/CEF-ingestible proxy data — uploads (large byte counts out) to AI endpoints
// Purpose: Bulk upload behavior toward AI platforms is the exfil indicator that matters; browsing is noise.
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("anthropic.com", "claude.ai", "openai.com")
| where SentBytes > 500000  // >500KB outbound — tune to baseline
| summarize TotalSentBytes = sum(SentBytes), Requests = count(),
    SampleURLs = make_set(RequestURL, 5)
    by SourceIP, SourceUserName, DeviceAction
| order by TotalSentBytes desc;

-- Artifact: SecurityArsenal_AI_Endpoint_Financial_Access_Hunt
-- Purpose: Identify processes on endpoints that BOTH access financial-data
-- file patterns AND hold active connections to AI platform infrastructure.
-- This intersection is the highest-fidelity indicator of financial data
-- being staged for upload to an AI assistant.

LET financial_glob = 'C:/Users/*/Downloads/**/*{statement,transaction,ofx,qfx,expense,plaid}*'

LET ai_net = SELECT Pid, Name, Path AS ExePath, Status, Family, Address, Port
FROM netstat()
WHERE Status =~ 'ESTABLISHED'

LET proc_fin = SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE CommandLine =~ '(?i)(statement|transactions|\.ofx|\.qfx|expense_export|reconciliation)'

SELECT proc_fin.Pid AS Pid,
       proc_fin.Name AS ProcessName,
       proc_fin.Exe AS Executable,
       proc_fin.CommandLine AS CommandLine,
       proc_fin.Username AS UserContext,
       ai_net.Address AS RemoteAddress,
       ai_net.Port AS RemotePort
FROM proc_fin
LEFT JOIN ai_net ON proc_fin.Pid = ai_net.Pid

# SecurityArsenal-ClaudeMoney-Assessment.ps1
# Purpose: Audit endpoint and tenant exposure to AI financial integrations.
# Run in audit mode first (no -Block switch) to establish a baseline.

param(
    [switch]$Block  # If specified, adds hosts-file egress blocks for AI API endpoints (use with caution)
)

$AiEndpoints = @("api.anthropic.com", "claude.ai", "api.openai.com")
$ErrorActionPreference = 'SilentlyContinue'

# 1. Identify processes with established connections to AI endpoints
Write-Host "[*] Checking active connections to AI endpoints..." -ForegroundColor Cyan
$connections = Get-NetTCPConnection -State Established |
    Where-Object { $_.RemotePort -eq 443 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess
        [PSCustomObject]@{
            ProcessName = $proc.ProcessName
            Path        = $proc.Path
            RemoteIP    = $_.RemoteAddress
            Resolved    = (Resolve-DnsName $_.RemoteAddress -Type PTR -ErrorAction SilentlyContinue).NameHost
        }
    }
$connections | Where-Object { $_.Resolved -match 'anthropic|openai|claude' } | Format-Table -AutoSize

# 2. Audit recently created/modified financial export files in user profiles
Write-Host "[*] Scanning user profiles for financial data export artifacts..." -ForegroundColor Cyan
Get-ChildItem -Path "C:\Users" -Recurse -Include *.ofx,*.qfx,*.qbo -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, LastWriteTime, Length | Format-Table -AutoSize

# 3. Check browser extension inventory for AI assistant extensions (Chrome/Edge)
Write-Host "[*] Enumerating installed AI-related browser extensions..." -ForegroundColor Cyan
$extPaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions",
              "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions")
foreach ($p in $extPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Directory | ForEach-Object {
            $manifest = Get-ChildItem $_.FullName -Recurse -Filter manifest.json | Select-Object -First 1
            if ($manifest) {
                $m = Get-Content $manifest.FullName -Raw | ConvertFrom-Json
                if ($m.name -match 'claude|anthropic|openai|chatgpt|finance|money') {
                    [PSCustomObject]@{ Extension = $m.name; ID = $_.Name; Browser = $p }
                }
            }
        }
    }
}

# 4. Optional: hosts-file egress block (containment stopgap — prefer proxy/CASB policy in production)
if ($Block) {
    Write-Host "[!] Adding hosts-file blocks for AI API endpoints..." -ForegroundColor Yellow
    $hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
    foreach ($ep in $AiEndpoints) {
        Add-Content -Path $hostsPath -Value "0.0.0.0 $ep"
    }
    Write-Host "[+] Blocks applied. Verify with: Get-Content $hostsPath" -ForegroundColor Green
}