LoFP / an agentcore agent that legitimately integrates with additional aws services will produce a first-time service call for its execution role. verify the role in \"aws.cloudtrail.user_identity.session_context.session_issuer.arn\", the action in \"event.action\" and \"event.provider\", and the origin in \"source.ip\" and \"source.as.organization.name\", and confirm the activity matches the agent's intended design. known agent integrations can be excluded after validation.

Techniques

• T1078
• T1552

Sample rules

AWS Bedrock AgentCore Execution Role Used Outside Its Runtime

• source: elastic
• technicques:
  • T1078
  • T1552

Description

Identifies an Amazon Bedrock AgentCore execution role (an AssumedRole identity whose role name begins with “AgentCore-” or contains “BedrockAgentCore”) making an AWS API call to a service it has not previously called. AgentCore runtimes normally interact only with Bedrock inference, AgentCore data-plane, and observability services (CloudWatch Logs, X-Ray, CloudWatch metrics), so an execution role suddenly calling STS, EC2, IAM, Secrets Manager, or other services is a strong indicator that the role’s temporary credentials were exfiltrated from the agent’s microVM (for example, via the Code Interpreter instance-metadata-service credential theft) and are being used outside the runtime for reconnaissance, privilege escalation, or lateral movement. Because the stolen credentials are recorded in CloudTrail under the execution role’s own identity, the anomalous service usage, not the identity, is the detectable signal.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and aws.cloudtrail.user_identity.type: "AssumedRole"
    and aws.cloudtrail.user_identity.session_context.session_issuer.arn: (*role/AgentCore-* or *role/*BedrockAgentCore*)
    and event.outcome: "success"
    and not event.provider: (
        "bedrock.amazonaws.com" or
        "bedrock-runtime.amazonaws.com" or
        "bedrock-agentcore.amazonaws.com" or
        "bedrock-agentcore-control.amazonaws.com" or
        "logs.amazonaws.com" or
        "xray.amazonaws.com" or
        "monitoring.amazonaws.com" or
        "ecr.amazonaws.com" or
        "ecr-public.amazonaws.com"
    )