LoFP / first-time bedrock onboarding by a developer using long-term iam user credentials. verify the requesting identity is a known engineer, the use case description is legitimate, and the model invocation follows expected application behavior. consider migrating bedrock workloads to iam roles to eliminate this pattern.

Techniques

• T1078
• T1526

Sample rules

AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key

• source: elastic
• technicques:
  • T1078
  • T1526

Description

Detects when an AWS principal using long-term IAM user credentials (AKIA* access key) enumerates available Bedrock foundation models and then invokes a model within the same 15-minute window. Most legitimate Bedrock workloads run under IAM roles with short-lived credentials; the combination of model enumeration followed by direct model invocation from a long-term IAM user key is unusual in production environments and consistent with an adversary using stolen credentials to discover and exploit available AI model capabilities. This pattern is associated with LLMjacking attacks where threat actors abuse compromised cloud credentials to run high-volume or high-cost model inference at the account owner’s expense.

Detection logic

sequence by aws.cloudtrail.user_identity.access_key_id with maxspan=15m
  [any where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "bedrock.amazonaws.com"
    and event.action == "ListFoundationModels"
    and event.outcome == "success"
    and aws.cloudtrail.user_identity.access_key_id like "AKIA*"]
  [any where data_stream.dataset == "aws.cloudtrail"
    and event.provider == "bedrock.amazonaws.com"
    and event.action : ("InvokeModel", "InvokeModelWithResponseStream", "Converse", "ConverseStream")
    and event.outcome == "success"]