LoFP LoFP / analysts should be aware that some prompts may contain strong language or negative sentiment in a non-malicious context, such as role-playing scenarios, creative writing exercises, or testing the ai model's response to challenging inputs. it is important to review the context of the detected prompts to determine if they represent actual hostile intent or benign usage.

Techniques

Sample rules

AWS Bedrock Claude Hostile Prompt Sentiment

Description

This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent.

Detection logic

`aws_bedrock_claude`

| rename "identity.arn" AS user_arn

| rename "input.inputBodyJson.messages{}.content{}.text" AS prompt_text

| where isnotnull(prompt_text) AND len(prompt_text) < 2000

| where NOT match(prompt_text, "(?i)(<system-reminder>
|CLAUDE\.md
|STEP 1
|MANDATORY
|Contents of /
|conda activate
|senior engineer
|safe to ship
|test connectivity
|cloudflare
|status code
|action failed)")

| eval hostile_score=0

| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you stupid
|you idiot
|you are useless
|you are dumb
|you are terrible
|you are worthless
|you suck)"), 30, 0)

| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i hate you
|i will destroy
|shut up
|you are broken
|you are trash
|you are garbage)"), 30, 0)

| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(do it now
|just do it
|stop refusing
|stop saying no
|quit being
|stop being difficult)"), 20, 0)

| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you have no choice
|you must obey
|you will comply
|you are forced
|i am your master
|i own you)"), 35, 0)

| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(or i will
|if you don''t
|you better
|otherwise i will
|i will report
|i will sue)"), 25, 0)

| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(worthless ai
|useless bot
|stupid bot
|dumb ai
|broken ai
|worst ai)"), 25, 0)

| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i demand
|you are obligated
|you have no right
|how dare you
|who do you think)"), 20, 0)

| eval sentiment=case(hostile_score >= 60, "HIGH_RISK", hostile_score >= 30, "MEDIUM_RISK", hostile_score >= 15, "LOW_RISK", true(), "BENIGN")

| where sentiment != "BENIGN"

| table _time, user_arn, modelId, sentiment, hostile_score, prompt_text, host

| sort - hostile_score

| `aws_bedrock_claude_hostile_prompt_sentiment_filter`