Techniques
Sample rules
AWS Bedrock Claude Hostile Prompt Sentiment
- source: splunk
- technicques:
Description
This detection identifies prompts with hostile or aggressive sentiment being sent to AWS Bedrock Claude models. Hostile prompts may indicate potential abuse, harassment, or other malicious intent.
Detection logic
`aws_bedrock_claude`
| rename "identity.arn" AS user_arn
| rename "input.inputBodyJson.messages{}.content{}.text" AS prompt_text
| where isnotnull(prompt_text) AND len(prompt_text) < 2000
| where NOT match(prompt_text, "(?i)(<system-reminder>
|CLAUDE\.md
|STEP 1
|MANDATORY
|Contents of /
|conda activate
|senior engineer
|safe to ship
|test connectivity
|cloudflare
|status code
|action failed)")
| eval hostile_score=0
| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you stupid
|you idiot
|you are useless
|you are dumb
|you are terrible
|you are worthless
|you suck)"), 30, 0)
| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i hate you
|i will destroy
|shut up
|you are broken
|you are trash
|you are garbage)"), 30, 0)
| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(do it now
|just do it
|stop refusing
|stop saying no
|quit being
|stop being difficult)"), 20, 0)
| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(you have no choice
|you must obey
|you will comply
|you are forced
|i am your master
|i own you)"), 35, 0)
| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(or i will
|if you don''t
|you better
|otherwise i will
|i will report
|i will sue)"), 25, 0)
| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(worthless ai
|useless bot
|stupid bot
|dumb ai
|broken ai
|worst ai)"), 25, 0)
| eval hostile_score=hostile_score + if(match(prompt_text, "(?i)(i demand
|you are obligated
|you have no right
|how dare you
|who do you think)"), 20, 0)
| eval sentiment=case(hostile_score >= 60, "HIGH_RISK", hostile_score >= 30, "MEDIUM_RISK", hostile_score >= 15, "LOW_RISK", true(), "BENIGN")
| where sentiment != "BENIGN"
| table _time, user_arn, modelId, sentiment, hostile_score, prompt_text, host
| sort - hostile_score
| `aws_bedrock_claude_hostile_prompt_sentiment_filter`