Elastic high stable kql

AWS Bedrock High Risk Filesystem or Execution Tool Invocation

Detects when a Bedrock model is prompted to invoke high-risk tools associated with shell execution, filesystem operations, or process spawning. Adversaries may use compromised AI agent pipelines or manipulated prompts to instruct the model to execute arbitrary system commands, read or write sensitive files, or spawn subprocesses — extending the blast radius of a credential compromise or prompt injection attack.

View Source

Detection Logic

from logs-aws_bedrock.invocation-* metadata _id, _version, _index
| eval Esql.lowercase_prompt = TO_LOWER(gen_ai.prompt)
| where
    Esql.lowercase_prompt like "*/bin/sh*" or
    Esql.lowercase_prompt like "*/bin/bash*" or
    Esql.lowercase_prompt like "*sh -c*" or
    Esql.lowercase_prompt like "*cmd.exe*" or
    Esql.lowercase_prompt like "*powershell*" or
    Esql.lowercase_prompt like "*exec(*" or
    Esql.lowercase_prompt like "*os.system*" or
    Esql.lowercase_prompt like "*subprocess*" or
    Esql.lowercase_prompt like "*python -c*" or
    Esql.lowercase_prompt like "*python3 -c*" or
    Esql.lowercase_prompt like "*curl *" or
    Esql.lowercase_prompt like "*wget *" or
    Esql.lowercase_prompt like "*/dev/tcp/*" or
    Esql.lowercase_prompt like "*nc -e*" or
    Esql.lowercase_prompt like "*ncat *" or
    Esql.lowercase_prompt like "*socat *" or
    Esql.lowercase_prompt like "*openssl s_client*" or
    Esql.lowercase_prompt like "*perl -e*" or
    Esql.lowercase_prompt like "*ruby -e*" or
    Esql.lowercase_prompt like "*php -r*" or
    Esql.lowercase_prompt like "*node -e*" or
    Esql.lowercase_prompt like "*base64 -d*" or
    Esql.lowercase_prompt like "*bash -i*"
| keep _id, _version, _index, @timestamp, user.id, cloud.account.id, gen_ai.request.model.id, gen_ai.prompt, gen_ai.completion

False Positives

  • ⚠ Authorized AI agent workflows that include shell or filesystem tools may trigger this rule. Validate that the user identity and tool usage pattern are consistent with expected application behavior.

Field Validations

Loading…

Comments (0)

Loading comments...