Elastic high stable eql

AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key

Detects when an AWS principal using long-term IAM user credentials (AKIA* access key) enumerates available Bedrock foundation models and then invokes a model within the same 15-minute window. Most legitimate Bedrock workloads run under IAM roles with short-lived credentials; the combination of model enumeration followed by direct model invocation from a long-term IAM user key is unusual in production environments and consistent with an adversary using stolen credentials to discover and exploit available AI model capabilities. This pattern is associated with LLMjacking attacks where threat actors abuse compromised cloud credentials to run high-volume or high-cost model inference at the account owner's expense.

View Source

Detection Logic

sequence by aws.cloudtrail.user_identity.access_key_id with maxspan=15m
  [any where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "bedrock.amazonaws.com"
    and event.action == "ListFoundationModels"
    and event.outcome == "success"
    and aws.cloudtrail.user_identity.access_key_id like "AKIA*"]
  [any where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "bedrock.amazonaws.com"
    and event.action : ("InvokeModel", "InvokeModelWithResponseStream", "Converse", "ConverseStream")
    and event.outcome == "success"]

False Positives

⚠ First-time Bedrock onboarding by a developer using long-term IAM user credentials. Verify the requesting identity is a known engineer, the use case description is legitimate, and the model invocation follows expected application behavior. Consider migrating Bedrock workloads to IAM roles to eliminate this pattern.

Field Validations

Loading…

Comments (0)

Loading comments...