LoFP / legitimate guardrail deletion by authorized identities.

Techniques

• t1685

Sample rules

AWS Bedrock Guardrail Deleted

• source: sigma
• technicques:
  • t1685

Description

Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses.

Detection logic

condition: selection
selection:
  eventName: DeleteGuardrail
  eventSource: bedrock.amazonaws.com