LoFP / machine learning engineers, mlops automation, or platform teams may legitimately import custom models or stand up marketplace model endpoints as part of normal model lifecycle operations. verify whether the user identity, user agent, source ip, and model artifact source (s3 location) are expected for your environment. imports performed by approved ci/cd or iac pipelines can be exempted from this rule. activity from unfamiliar identities or untrusted artifact sources should be investigated.

Techniques

• T1525

Sample rules

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered

• source: elastic
• technicques:
  • T1525

Description

Detects when an AWS Bedrock custom model is imported or deployed, or when a marketplace model endpoint is created or registered, via the CreateModelImportJob, CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, or RegisterMarketplaceModelEndpoint API calls. These actions introduce a model artifact from outside the organization’s trusted training and approval pipeline. A backdoored, poisoned, or attacker-supplied model that downstream applications subsequently invoke represents a software supply-chain compromise. New model imports and marketplace endpoint registrations should be validated for artifact provenance (S3 source ownership), the registering identity, and whether the model originates from an approved internal pipeline.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "bedrock.amazonaws.com"
    and event.action: (
        "CreateModelImportJob" or
        "CreateCustomModelDeployment" or
        "CreateMarketplaceModelEndpoint" or
        "RegisterMarketplaceModelEndpoint"
    )
    and event.outcome: "success"