From 708645d6c08f30219f86713548596b39cc61e1bc Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 25 Mar 2025 16:50:39 -0700 Subject: [PATCH 01/10] adding story file --- stories/aws_bedrock_security.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 stories/aws_bedrock_security.yml diff --git a/stories/aws_bedrock_security.yml b/stories/aws_bedrock_security.yml new file mode 100644 index 0000000000..ffb7299652 --- /dev/null +++ b/stories/aws_bedrock_security.yml @@ -0,0 +1,26 @@ +name: AWS Bedrock Security +id: fdc58e40-6b32-4a91-bc45-9f87d2e3c840 +version: 1 +date: '2024-12-05' +author: Bhavin Patel, Splunk +status: production +description: This analytic story contains detections that query your AWS CloudTrail and S3 access logs for activities related to potential security risks and malicious activities on Amazon Bedrock services. +narrative: 'Organizations increasingly leverage Amazon Bedrock to power their Generative AI (GenAI) applications. Adversaries with compromised AWS credentials can exploit Bedrock services and associated resources to perform malicious activities, extract sensitive data, or disrupt operations. + + Attackers often perform reconnaissance by repeatedly listing foundation models or making high volumes of API calls. They may attempt to evade detection by disabling logging configurations or deleting GuardRails that prevent harmful outputs. More sophisticated attacks include attaching manipulated training datasets for fine-tuning, deleting S3 buckets containing critical data, or performing LLM jacking where attackers compute their own responses to bypass security controls. + + This Analytic Story includes detections that identify suspicious activities against AWS Bedrock services, such as access denied events, spikes in GuardRail blocks, unusual API call patterns, configuration changes to logging, and manipulation of model security controls. These detections help organizations monitor for potential compromise of their Bedrock environment and identify attempts to bypass AI security measures through configuration changes or abuse of legitimate functionality.' +references: +- https://aws.amazon.com/bedrock/security/ +- https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html +- https://docs.aws.amazon.com/bedrock/latest/userguide/security-shared-responsibility.html +- https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html +tags: + category: + - Cloud Security + product: + - Splunk Security Analytics for AWS + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Security Monitoring \ No newline at end of file From 428413f23b17541455ee6378dfe69dc81e80bf00 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 25 Mar 2025 17:02:16 -0700 Subject: [PATCH 02/10] adding two bedrock detections --- ..._number_list_foundation_model_failures.yml | 66 +++++++++++++++++++ ...aws_bedrock_invoke_model_access_denied.yml | 65 ++++++++++++++++++ stories/aws_bedrock_security.yml | 2 +- 3 files changed, 132 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml create mode 100644 detections/cloud/aws_bedrock_invoke_model_access_denied.yml diff --git a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml new file mode 100644 index 0000000000..1e58c73722 --- /dev/null +++ b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml @@ -0,0 +1,66 @@ +name: AWS Bedrock High Number List Foundation Model Failures +id: e84b3c74-f742-11ee-9f6e-acde48001122 +version: 1 +date: '2024-12-05' +author: Bhavin Patel, Splunk +status: production +type: TTP +description: The following analytic identifies an unusually high number of failed attempts to list AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service experiences multiple failures when calling the ListFoundationModels API. This activity is significant as it may indicate an adversary performing reconnaissance of available AI models after compromising credentials with limited permissions. Repeated failures could suggest brute force attempts to enumerate accessible resources or misconfigured access controls. If confirmed malicious, this could represent early-stage reconnaissance before attempting to access or manipulate Bedrock models or knowledge bases. +data_source: +- AWS CloudTrail +search: >- + `cloudtrail` eventSource=bedrock.amazonaws.com eventName=ListFoundationModels errorCode=* + | stats count min(_time) as firstTime max(_time) as lastTime values(errorCode) as errorCodes values(errorMessage) as errorMessages by src user_agent aws_account_id eventName awsRegion userIdentity.sessionContext.sessionIssuer.userName userIdentity.arn + | rename userIdentity.sessionContext.sessionIssuer.userName as assumed_role userIdentity.arn as user + | where count > 10 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_bedrock_high_number_list_foundation_model_failures_filter` +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. +known_false_positives: Legitimate users may encounter multiple failures during permission testing, role transitions, or when service permissions are being reconfigured. High volumes of API errors may also occur during automated processes with misconfigured IAM policies or when new Bedrock features are being explored through API testing. +references: +- https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html +- https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cloudtrail.html +- https://attack.mitre.org/techniques/T1595/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ attempted to list AWS Bedrock foundation models $count$ times with failures from $src$ + risk_objects: + - field: user + type: user + score: 48 + threat_objects: + - field: src + type: ip_address +tags: + analytic_story: + - AWS Bedrock Security + asset_type: AWS Account + mitre_attack_id: + - T1595 + - T1087 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_list_foundation_models/aws_bedrock_list_foundation_models.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail \ No newline at end of file diff --git a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml new file mode 100644 index 0000000000..b3fc702a29 --- /dev/null +++ b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml @@ -0,0 +1,65 @@ +name: AWS Bedrock Invoke Model Access Denied +id: c53a8e62-f741-11ee-9f6e-acde48001122 +version: 1 +date: '2024-12-05' +author: Bhavin Patel, Splunk +status: production +type: TTP +description: The following analytic identifies access denied errors when attempting to invoke AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service receives an AccessDenied error when calling the InvokeModel API. This activity is significant as it may indicate an adversary attempting to access Bedrock models with insufficient permissions after compromising credentials. If confirmed malicious, this could suggest reconnaissance activities or privilege escalation attempts targeting generative AI resources, potentially leading to data exfiltration or manipulation of model outputs. +data_source: +- AWS CloudTrail +search: >- + `cloudtrail` eventSource=bedrock.amazonaws.com eventName=InvokeModel errorCode=AccessDenied + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters) as requestParameters values(errorMessage) as errorMessage by src user_agent aws_account_id eventName awsRegion userIdentity.sessionContext.sessionIssuer.userName userIdentity.arn + | rename userIdentity.sessionContext.sessionIssuer.userName as assumed_role userIdentity.arn as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_bedrock_invoke_model_access_denied_filter` +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. +known_false_positives: Legitimate users may encounter access denied errors during permission testing, role transitions, or when service permissions are being reconfigured. Access denials may also happen when automated processes are using outdated credentials or when new Bedrock features are being explored. +references: +- https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html +- https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cloudtrail.html +- https://attack.mitre.org/techniques/T1078/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ received access denied errors when attempting to invoke AWS Bedrock models from $src$ + risk_objects: + - field: user + type: user + score: 64 + threat_objects: + - field: src + type: ip_address +tags: + analytic_story: + - AWS Bedrock Security + asset_type: AWS Account + mitre_attack_id: + - T1078 + - T1550 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_access_denied/aws_bedrock_access_denied.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail \ No newline at end of file diff --git a/stories/aws_bedrock_security.yml b/stories/aws_bedrock_security.yml index ffb7299652..4313af65ed 100644 --- a/stories/aws_bedrock_security.yml +++ b/stories/aws_bedrock_security.yml @@ -4,7 +4,7 @@ version: 1 date: '2024-12-05' author: Bhavin Patel, Splunk status: production -description: This analytic story contains detections that query your AWS CloudTrail and S3 access logs for activities related to potential security risks and malicious activities on Amazon Bedrock services. +description: This analytic story contains detections that query your AWS CloudTrail and CloudWatch logs for activities related to potential security risks and malicious activities on Amazon Bedrock services. narrative: 'Organizations increasingly leverage Amazon Bedrock to power their Generative AI (GenAI) applications. Adversaries with compromised AWS credentials can exploit Bedrock services and associated resources to perform malicious activities, extract sensitive data, or disrupt operations. Attackers often perform reconnaissance by repeatedly listing foundation models or making high volumes of API calls. They may attempt to evade detection by disabling logging configurations or deleting GuardRails that prevent harmful outputs. More sophisticated attacks include attaching manipulated training datasets for fine-tuning, deleting S3 buckets containing critical data, or performing LLM jacking where attackers compute their own responses to bypass security controls. From 7a9ebda18facc8e6fad97e322eb203704dfacdb0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 25 Mar 2025 17:38:14 -0700 Subject: [PATCH 03/10] delete guardrail --- .../cloud/aws_bedrock_delete_guardrails.yml | 65 +++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 detections/cloud/aws_bedrock_delete_guardrails.yml diff --git a/detections/cloud/aws_bedrock_delete_guardrails.yml b/detections/cloud/aws_bedrock_delete_guardrails.yml new file mode 100644 index 0000000000..dfbcf9b440 --- /dev/null +++ b/detections/cloud/aws_bedrock_delete_guardrails.yml @@ -0,0 +1,65 @@ +name: AWS Bedrock Delete GuardRails +id: 7a5e3d62-f743-11ee-9f6e-acde48001122 +version: 1 +date: '2024-12-05' +author: Bhavin Patel, Splunk +status: production +type: TTP +description: The following analytic identifies attempts to delete AWS Bedrock GuardRails, which are security controls designed to prevent harmful, biased, or inappropriate AI outputs. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteGuardrail API. This activity is significant as it may indicate an adversary attempting to remove safety guardrails after compromising credentials, potentially to enable harmful or malicious model outputs. Removing guardrails could allow attackers to extract sensitive information, generate offensive content, or bypass security controls designed to prevent prompt injection and other AI-specific attacks. If confirmed malicious, this could represent a deliberate attempt to manipulate model behavior for harmful purposes. +data_source: +- AWS CloudTrail +search: >- + `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteGuardrail + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.guardrailIdentifier) as guardrailIds values(responseElements.httpStatus) as httpStatus by src user_agent aws_account_id eventName awsRegion userIdentity.sessionContext.sessionIssuer.userName userIdentity.arn + | rename userIdentity.sessionContext.sessionIssuer.userName as assumed_role userIdentity.arn as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_bedrock_delete_guardrails_filter` +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock GuardRails management events. +known_false_positives: Legitimate administrators may delete GuardRails as part of normal operations, such as when replacing outdated guardrails with updated versions, cleaning up test resources, or consolidating security controls. Consider implementing an allowlist for expected administrators who regularly manage GuardRails configurations. +references: +- https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html +- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html +- https://attack.mitre.org/techniques/T1562/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ deleted AWS Bedrock GuardRails $guardrailIds$ from $src$ + risk_objects: + - field: user + type: user + score: 72 + threat_objects: + - field: src + type: ip_address +tags: + analytic_story: + - AWS Bedrock Security + asset_type: AWS Account + mitre_attack_id: + - T1562 + - T1562.008 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_guardrails/aws_bedrock_delete_guardrails.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail \ No newline at end of file From 70174e83184d1af10a819a3a96d07de038908087 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 1 Apr 2025 12:45:27 -0700 Subject: [PATCH 04/10] update detection --- detections/cloud/aws_bedrock_delete_guardrails.yml | 7 +++---- .../cloud/aws_bedrock_invoke_model_access_denied.yml | 8 ++++---- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/detections/cloud/aws_bedrock_delete_guardrails.yml b/detections/cloud/aws_bedrock_delete_guardrails.yml index dfbcf9b440..f7c1b577cc 100644 --- a/detections/cloud/aws_bedrock_delete_guardrails.yml +++ b/detections/cloud/aws_bedrock_delete_guardrails.yml @@ -10,10 +10,10 @@ data_source: - AWS CloudTrail search: >- `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteGuardrail - | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.guardrailIdentifier) as guardrailIds values(responseElements.httpStatus) as httpStatus by src user_agent aws_account_id eventName awsRegion userIdentity.sessionContext.sessionIssuer.userName userIdentity.arn - | rename userIdentity.sessionContext.sessionIssuer.userName as assumed_role userIdentity.arn as user + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.guardrailIdentifier) as guardrailIds by src user user_agent vendor_account signature vendor_region | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `aws_bedrock_delete_guardrails_filter` how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock GuardRails management events. known_false_positives: Legitimate administrators may delete GuardRails as part of normal operations, such as when replacing outdated guardrails with updated versions, cleaning up test resources, or consolidating security controls. Consider implementing an allowlist for expected administrators who regularly manage GuardRails configurations. @@ -49,7 +49,6 @@ tags: - AWS Bedrock Security asset_type: AWS Account mitre_attack_id: - - T1562 - T1562.008 product: - Splunk Enterprise diff --git a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml index b3fc702a29..07c927a4d4 100644 --- a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml +++ b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml @@ -5,15 +5,15 @@ date: '2024-12-05' author: Bhavin Patel, Splunk status: production type: TTP -description: The following analytic identifies access denied errors when attempting to invoke AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service receives an AccessDenied error when calling the InvokeModel API. This activity is significant as it may indicate an adversary attempting to access Bedrock models with insufficient permissions after compromising credentials. If confirmed malicious, this could suggest reconnaissance activities or privilege escalation attempts targeting generative AI resources, potentially leading to data exfiltration or manipulation of model outputs. +description: The following analytic identifies access denied errors when attempting to invoke AWS Bedrock models. It leverages AWS CloudTrail logs to detect when a user or service receives an AccessDenied error when calling the InvokeModel API. This activity is significant as it may indicate an adversary attempting to access Bedrock models with insufficient permissions after compromising credentials. If confirmed malicious, this could suggest reconnaissance activities or privilege escalation attempts targeting generative AI resources, potentially leading to data exfiltration or manipulation of model outputs. data_source: - AWS CloudTrail search: >- `cloudtrail` eventSource=bedrock.amazonaws.com eventName=InvokeModel errorCode=AccessDenied - | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters) as requestParameters values(errorMessage) as errorMessage by src user_agent aws_account_id eventName awsRegion userIdentity.sessionContext.sessionIssuer.userName userIdentity.arn - | rename userIdentity.sessionContext.sessionIssuer.userName as assumed_role userIdentity.arn as user + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.modelId) as modelIds by src user user_agent vendor_account signature vendor_region result result_id | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `aws_bedrock_invoke_model_access_denied_filter` how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. known_false_positives: Legitimate users may encounter access denied errors during permission testing, role transitions, or when service permissions are being reconfigured. Access denials may also happen when automated processes are using outdated credentials or when new Bedrock features are being explored. From 1b2f69d1376c6b657d76d4ac201a88425f5eddc9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 3 Apr 2025 12:13:43 -0700 Subject: [PATCH 05/10] adding new detection file --- ...l_invocation_logging_configuration.yml.yml | 64 +++++++++++++++++++ ..._number_list_foundation_model_failures.yml | 11 ++-- ...aws_bedrock_invoke_model_access_denied.yml | 4 +- 3 files changed, 71 insertions(+), 8 deletions(-) create mode 100644 detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml.yml diff --git a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml.yml b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml.yml new file mode 100644 index 0000000000..6a0e84127f --- /dev/null +++ b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml.yml @@ -0,0 +1,64 @@ +name: AWS Bedrock Delete Model Invocation Logging Configuration +id: 9c5e3d62-f743-11ee-9f6e-acde48001124 +version: 1 +date: '2024-12-05' +author: Bhavin Patel, Splunk +status: production +type: TTP +description: The following analytic identifies attempts to delete AWS Bedrock model invocation logging configurations. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteModelInvocationLogging API. This activity is significant as it may indicate an adversary attempting to remove audit trails of model interactions after compromising credentials. Deleting model invocation logs could allow attackers to interact with AI models without leaving traces, potentially enabling them to conduct data exfiltration, prompt injection attacks, or other malicious activities without detection. If confirmed malicious, this could represent a deliberate attempt to hide unauthorized model usage and evade detection. +data_source: +- AWS CloudTrail +search: >- + `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteModelInvocationLoggingConfiguration + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime by src user user_agent vendor_account signature vendor_region + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_bedrock_delete_model_invocation_logging_configuration_filter` +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock model invocation logging management events. +known_false_positives: Legitimate administrators may delete model invocation logging configurations during maintenance, when updating logging policies, or when cleaning up unused resources. Consider implementing an allowlist for expected administrators who regularly manage logging configurations. +references: +- https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring.html +- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteModelInvocationLogging.html +- https://attack.mitre.org/techniques/T1562/008/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ deleted AWS Bedrock model invocation logging for models $modelIds$ from $src$ + risk_objects: + - field: user + type: user + score: 75 + threat_objects: + - field: src + type: ip_address +tags: + analytic_story: + - AWS Bedrock Security + asset_type: AWS Account + mitre_attack_id: + - T1562.008 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_logging/aws_bedrock_delete_model_invocation_logging.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail \ No newline at end of file diff --git a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml index 1e58c73722..ebe8e866c5 100644 --- a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml +++ b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml @@ -5,16 +5,15 @@ date: '2024-12-05' author: Bhavin Patel, Splunk status: production type: TTP -description: The following analytic identifies an unusually high number of failed attempts to list AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service experiences multiple failures when calling the ListFoundationModels API. This activity is significant as it may indicate an adversary performing reconnaissance of available AI models after compromising credentials with limited permissions. Repeated failures could suggest brute force attempts to enumerate accessible resources or misconfigured access controls. If confirmed malicious, this could represent early-stage reconnaissance before attempting to access or manipulate Bedrock models or knowledge bases. +description: The following analytic identifies an high number of AccessDenied attempts to list AWS Bedrock foundation models. It leverages AWS CloudTrail logs to detect when a user or service experiences multiple failures when calling the ListFoundationModels API. This activity is significant as it may indicate an adversary performing reconnaissance of available AI models after compromising credentials with limited permissions. Repeated failures could suggest brute force attempts to enumerate accessible resources or misconfigured access controls. If confirmed malicious, this could represent early-stage reconnaissance before attempting to access or manipulate Bedrock models or knowledge bases. data_source: - AWS CloudTrail search: >- - `cloudtrail` eventSource=bedrock.amazonaws.com eventName=ListFoundationModels errorCode=* - | stats count min(_time) as firstTime max(_time) as lastTime values(errorCode) as errorCodes values(errorMessage) as errorMessages by src user_agent aws_account_id eventName awsRegion userIdentity.sessionContext.sessionIssuer.userName userIdentity.arn - | rename userIdentity.sessionContext.sessionIssuer.userName as assumed_role userIdentity.arn as user - | where count > 10 + sourcetype=aws:cloudtrail eventSource=bedrock.amazonaws.com eventName=ListFoundationModels errorCode=AccessDenied | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(errorCode) as errorCodes values(errorMessage) as errorMessages by src user user_agent vendor_account signature vendor_region + | where count > 9 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` + | `security_content_ctime(lastTime)` | `aws_bedrock_high_number_list_foundation_model_failures_filter` how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. known_false_positives: Legitimate users may encounter multiple failures during permission testing, role transitions, or when service permissions are being reconfigured. High volumes of API errors may also occur during automated processes with misconfigured IAM policies or when new Bedrock features are being explored through API testing. diff --git a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml index 07c927a4d4..93f3d9f142 100644 --- a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml +++ b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml @@ -5,7 +5,7 @@ date: '2024-12-05' author: Bhavin Patel, Splunk status: production type: TTP -description: The following analytic identifies access denied errors when attempting to invoke AWS Bedrock models. It leverages AWS CloudTrail logs to detect when a user or service receives an AccessDenied error when calling the InvokeModel API. This activity is significant as it may indicate an adversary attempting to access Bedrock models with insufficient permissions after compromising credentials. If confirmed malicious, this could suggest reconnaissance activities or privilege escalation attempts targeting generative AI resources, potentially leading to data exfiltration or manipulation of model outputs. +description: The following analytic identifies access denied error when attempting to invoke AWS Bedrock models. It leverages AWS CloudTrail logs to detect when a user or service receives an AccessDenied error when calling the InvokeModel API. This activity is significant as it may indicate an adversary attempting to access Bedrock models with insufficient permissions after compromising credentials. If confirmed malicious, this could suggest reconnaissance activities or privilege escalation attempts targeting generative AI resources, potentially leading to data exfiltration or manipulation of model outputs. data_source: - AWS CloudTrail search: >- @@ -36,7 +36,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user$ received access denied errors when attempting to invoke AWS Bedrock models from $src$ + message: User $user$ access denied when attempting to invoke AWS Bedrock models from $src$ risk_objects: - field: user type: user From 032dbfda688ab44d45cc2de89b210aad1d9527e2 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 3 Apr 2025 16:55:45 -0700 Subject: [PATCH 06/10] adding kb detection --- .../aws_bedrock_delete_knowledge_base.yml | 64 +++++++++++++++++++ ...odel_invocation_logging_configuration.yml} | 0 2 files changed, 64 insertions(+) create mode 100644 detections/cloud/aws_bedrock_delete_knowledge_base.yml rename detections/cloud/{aws_bedrock_delete_model_invocation_logging_configuration.yml.yml => aws_bedrock_delete_model_invocation_logging_configuration.yml} (100%) diff --git a/detections/cloud/aws_bedrock_delete_knowledge_base.yml b/detections/cloud/aws_bedrock_delete_knowledge_base.yml new file mode 100644 index 0000000000..98c9cc814a --- /dev/null +++ b/detections/cloud/aws_bedrock_delete_knowledge_base.yml @@ -0,0 +1,64 @@ +name: AWS Bedrock Delete Knowledge Base +id: 8b4e3d62-f743-11ee-9f6e-acde48001123 +version: 1 +date: '2024-12-05' +author: Bhavin Patel, Splunk +status: production +type: TTP +description: The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. It monitors AWS CloudTrail logs for DeleteKnowledgeBase API calls. This activity could indicate an adversary attempting to remove knowledge bases after compromising credentials, potentially to disrupt business operations or remove traces of data access. Deleting knowledge bases could impact model performance, remove critical business context, or be part of a larger attack to degrade AI capabilities. If confirmed malicious, this could represent a deliberate attempt to cause service disruption or data loss. +data_source: +- AWS CloudTrail +search: >- + `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteKnowledgeBase + | rename user_name as user + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.knowledgeBaseId) as knowledgeBaseIds by src user user_agent vendor_account signature vendor_region + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_bedrock_delete_knowledge_base_filter` +how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock Knowledge Base management events. +known_false_positives: Legitimate administrators may delete Knowledge Bases as part of normal operations, such as when replacing outdated knowledge bases, removing test resources, or consolidating information. Consider implementing an allowlist for expected administrators who regularly manage Knowledge Base configurations. +references: +- https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-bases.html +- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteKnowledgeBase.html +- https://attack.mitre.org/techniques/T1562/ +drilldown_searches: +- name: View the detection results for - "$user$" + search: '%original_detection_search% | search user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ deleted AWS Bedrock Knowledge Base $knowledgeBaseIds$ from $src$ + risk_objects: + - field: user + type: user + score: 70 + threat_objects: + - field: src + type: ip_address +tags: + analytic_story: + - AWS Bedrock Security + asset_type: AWS Account + mitre_attack_id: + - T1562.008 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_knowledge_base/aws_bedrock_delete_knowledge_base.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail \ No newline at end of file diff --git a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml.yml b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml similarity index 100% rename from detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml.yml rename to detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml From d28418800be3fd9368eda1c6fb6b1ce5c836b464 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 3 Apr 2025 17:13:18 -0700 Subject: [PATCH 07/10] fix with validate --- ...ws_bedrock_delete_model_invocation_logging_configuration.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml index 6a0e84127f..8e993ad90a 100644 --- a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml +++ b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml @@ -36,7 +36,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user$ deleted AWS Bedrock model invocation logging for models $modelIds$ from $src$ + message: User $user$ deleted AWS Bedrock model invocation logging from $src$ risk_objects: - field: user type: user From 1cbf9d3d2d3e3e21250946206d9d209a10386f6e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 9 Apr 2025 16:06:07 -0700 Subject: [PATCH 08/10] updating and testing aws detections --- detections/cloud/aws_bedrock_delete_guardrails.yml | 2 +- detections/cloud/aws_bedrock_delete_knowledge_base.yml | 4 ++-- ...drock_delete_model_invocation_logging_configuration.yml | 2 +- ..._bedrock_high_number_list_foundation_model_failures.yml | 7 +++---- .../cloud/aws_bedrock_invoke_model_access_denied.yml | 2 +- 5 files changed, 8 insertions(+), 9 deletions(-) diff --git a/detections/cloud/aws_bedrock_delete_guardrails.yml b/detections/cloud/aws_bedrock_delete_guardrails.yml index f7c1b577cc..224daa7842 100644 --- a/detections/cloud/aws_bedrock_delete_guardrails.yml +++ b/detections/cloud/aws_bedrock_delete_guardrails.yml @@ -59,6 +59,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_guardrails/aws_bedrock_delete_guardrails.json + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_bedrock_delete_guardrails/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail \ No newline at end of file diff --git a/detections/cloud/aws_bedrock_delete_knowledge_base.yml b/detections/cloud/aws_bedrock_delete_knowledge_base.yml index 98c9cc814a..b53fab1f62 100644 --- a/detections/cloud/aws_bedrock_delete_knowledge_base.yml +++ b/detections/cloud/aws_bedrock_delete_knowledge_base.yml @@ -49,7 +49,7 @@ tags: - AWS Bedrock Security asset_type: AWS Account mitre_attack_id: - - T1562.008 + - T1485 product: - Splunk Enterprise - Splunk Enterprise Security @@ -59,6 +59,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_knowledge_base/aws_bedrock_delete_knowledge_base.json + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/aws_delete_knowledge_base/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail \ No newline at end of file diff --git a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml index 8e993ad90a..93724a15c7 100644 --- a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml +++ b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml @@ -59,6 +59,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_logging/aws_bedrock_delete_model_invocation_logging.json + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.008/aws_bedrock_delete_model_invocation_logging/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail \ No newline at end of file diff --git a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml index ebe8e866c5..e79b5a2bc2 100644 --- a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml +++ b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml @@ -9,7 +9,7 @@ description: The following analytic identifies an high number of AccessDenied at data_source: - AWS CloudTrail search: >- - sourcetype=aws:cloudtrail eventSource=bedrock.amazonaws.com eventName=ListFoundationModels errorCode=AccessDenied | rename user_name as user + `cloudtrail` eventSource=bedrock.amazonaws.com eventName=ListFoundationModels errorCode=AccessDenied | rename user_name as user | stats count min(_time) as firstTime max(_time) as lastTime values(errorCode) as errorCodes values(errorMessage) as errorMessages by src user user_agent vendor_account signature vendor_region | where count > 9 | `security_content_ctime(firstTime)` @@ -49,8 +49,7 @@ tags: - AWS Bedrock Security asset_type: AWS Account mitre_attack_id: - - T1595 - - T1087 + - T1580 product: - Splunk Enterprise - Splunk Enterprise Security @@ -60,6 +59,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_list_foundation_models/aws_bedrock_list_foundation_models.json + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_bedrock_list_foundation_model_failures/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail \ No newline at end of file diff --git a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml index 93f3d9f142..7273fdf03a 100644 --- a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml +++ b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml @@ -60,6 +60,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/aws_bedrock_access_denied/aws_bedrock_access_denied.json + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.004/aws_invoke_model_access_denied/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail \ No newline at end of file From 524136ee6cae8ee1a93e988835b7142502867296 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 17 Apr 2025 14:38:23 -0700 Subject: [PATCH 09/10] adding data sources --- .../aws_cloudtrail_deleteguardrail.yml | 121 ++++++++++++++++ .../aws_cloudtrail_deleteknowledgebase.yml | 108 ++++++++++++++ ...etemodelinvocationloggingconfiguration.yml | 132 ++++++++++++++++++ data_sources/aws_cloudtrail_invokemodel.yml | 121 ++++++++++++++++ .../aws_cloudtrail_listfoundationmodels.yml | 119 ++++++++++++++++ 5 files changed, 601 insertions(+) create mode 100644 data_sources/aws_cloudtrail_deleteguardrail.yml create mode 100644 data_sources/aws_cloudtrail_deleteknowledgebase.yml create mode 100644 data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml create mode 100644 data_sources/aws_cloudtrail_invokemodel.yml create mode 100644 data_sources/aws_cloudtrail_listfoundationmodels.yml diff --git a/data_sources/aws_cloudtrail_deleteguardrail.yml b/data_sources/aws_cloudtrail_deleteguardrail.yml new file mode 100644 index 0000000000..9877d3f4ef --- /dev/null +++ b/data_sources/aws_cloudtrail_deleteguardrail.yml @@ -0,0 +1,121 @@ +name: AWS CloudTrail DeleteGuardrail +id: 2f6e9d7a-1c53-48b1-be57-33a91e0f8c42 +version: 1 +date: '2023-10-15' +author: Bhavin Patel, Splunk +description: Logs an event when a guardrail is deleted within the AWS CloudTrail. +mitre_components: +- Cloud Service Modification +source: aws_cloudtrail +sourcetype: aws:cloudtrail +separator: eventName +separator_value: DeleteGuardrail +supported_TA: +- name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 7.9.1 +fields: +- _time +- action +- app +- awsRegion +- aws_account_id +- change_type +- command +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- direction +- dvc +- errorCode +- eventCategory +- eventID +- eventName +- eventSource +- eventTime +- eventType +- eventVersion +- eventtype +- host +- index +- linecount +- managementEvent +- msg +- object_category +- product +- protocol +- protocol_code +- punct +- readOnly +- recipientAccountId +- region +- requestID +- requestParameters.guardrailId +- responseElements.requestId +- signature +- source +- sourceIPAddress +- sourcetype +- splunk_server +- src +- src_ip +- src_ip_range +- start_time +- status +- tag +- tag::eventtype +- timeendpos +- timestartpos +- user +- userAgent +- userIdentity.accessKeyId +- userIdentity.accountId +- userIdentity.arn +- userIdentity.principalId +- userIdentity.sessionContext.attributes.creationDate +- userIdentity.sessionContext.attributes.mfaAuthenticated +- userIdentity.sessionContext.sessionIssuer.accountId +- userIdentity.sessionContext.sessionIssuer.arn +- userIdentity.sessionContext.sessionIssuer.principalId +- userIdentity.sessionContext.sessionIssuer.type +- userIdentity.sessionContext.sessionIssuer.userName +- userIdentity.type +- userName +- user_access_key +- user_agent +- user_arn +- user_group_id +- user_id +- user_name +- user_type +- vendor +- vendor_account +- vendor_product +- vendor_region +example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": + "AROAIJIESMXKGCJRCTPR6:user@example.com", "arn": "arn:aws:sts::111111111111:assumed-role/admin_role/user@example.com", + "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLXXXXXXXX", "sessionContext": + {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": + "arn:aws:iam::111111111111:role/admin_role", "accountId": "111111111111", "userName": + "admin_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": + "false", "creationDate": "2023-10-15T08:36:15Z"}}}, "eventTime": "2023-10-15T08:49:49Z", + "eventSource": "bedrock.amazonaws.com", "eventName": "DeleteGuardrail", "awsRegion": + "us-east-1", "sourceIPAddress": "192.0.2.1", "userAgent": "aws-cli/2.9.15", + "requestParameters": {"guardrailId": "grail-12345abcdef"}, + "responseElements": {"requestId": "97b40da9-9291-4a92-8e9e-892b6887ffc9"}, + "requestID": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "eventID": + "46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": false, "eventType": "AwsApiCall", + "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +output_fields: +- dest +- user +- user_agent +- src +- vendor_account +- vendor_region +- vendor_product \ No newline at end of file diff --git a/data_sources/aws_cloudtrail_deleteknowledgebase.yml b/data_sources/aws_cloudtrail_deleteknowledgebase.yml new file mode 100644 index 0000000000..be42829a79 --- /dev/null +++ b/data_sources/aws_cloudtrail_deleteknowledgebase.yml @@ -0,0 +1,108 @@ +name: AWS CloudTrail DeleteKnowledgeBase +id: a8c47f25-5693-4d1a-9f8b-6e94d15ac2d9 +version: 1 +date: '2023-10-15' +author: Bhavin Patel, Splunk +description: Logs an event when a knowledge base is deleted within the AWS CloudTrail. +mitre_components: +- Cloud Service Modification +source: aws_cloudtrail +sourcetype: aws:cloudtrail +separator: eventName +separator_value: DeleteKnowledgeBase +supported_TA: +- name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 7.9.1 +fields: +- _time +- action +- app +- awsRegion +- aws_account_id +- change_type +- command +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- direction +- dvc +- errorCode +- eventCategory +- eventID +- eventName +- eventSource +- eventTime +- eventType +- eventVersion +- eventtype +- host +- index +- linecount +- managementEvent +- msg +- object_category +- product +- protocol +- protocol_code +- punct +- readOnly +- recipientAccountId +- region +- requestID +- requestParameters.knowledgeBaseId +- responseElements.requestId +- signature +- source +- sourceIPAddress +- sourcetype +- splunk_server +- src +- src_ip +- src_ip_range +- start_time +- status +- tag +- tag::eventtype +- timeendpos +- timestartpos +- user +- userAgent +- userIdentity.accessKeyId +- userIdentity.accountId +- userIdentity.arn +- userIdentity.principalId +- userIdentity.sessionContext.attributes.creationDate +- userIdentity.sessionContext.attributes.mfaAuthenticated +- userIdentity.sessionContext.sessionIssuer.accountId +- userIdentity.sessionContext.sessionIssuer.arn +- userIdentity.sessionContext.sessionIssuer.principalId +- userIdentity.sessionContext.sessionIssuer.type +- userIdentity.sessionContext.sessionIssuer.userName +- userIdentity.type +- userName +- user_access_key +- user_agent +- user_arn +- user_group_id +- user_id +- user_name +- user_type +- vendor +- vendor_account +- vendor_product +- vendor_region +example_log: '{"eventVersion": "1.09", "userIdentity": {"type": "AssumedRole", "principalId": "AROA:bpatel@splunk.com", "arn": "arn:aws:sts::111111111:assumed-role/daftpunk/bpatel@splunk.com", "accountId": "111111111", "accessKeyId": "ASIAYTOGP2RLLIVGGYLX", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROA", "arn": "arn:aws:iam::111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/daftpunk", "accountId": "111111111", "userName": "daftpunk"}, "attributes": {"creationDate": "2025-04-03T21:50:08Z", "mfaAuthenticated": "false"}}}, "eventTime": "2025-04-03T23:49:06Z", "eventSource": "bedrock.amazonaws.com", "eventName": "DeleteKnowledgeBase", "awsRegion": "us-west-2", "sourceIPAddress": "23.93.242.200", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36", "requestParameters": {"knowledgeBaseId": "T9PFUXGAPO"}, "responseElements": {"Access-Control-Expose-Headers": "x-amzn-Apigw-id,x-amzn-ErrorMessage,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-Trace-id,refreshtoken,Date", "knowledgeBaseId": "T9PFUXGAPO", "status": "DELETING"}, "requestID": "9dfbaf92-e781-4837-ad53-d72e20be1ac2", "eventID": "bff5a344-3908-41f0-bb57-d57a01014ff3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111", "eventCategory": "Management"}' +output_fields: +- dest +- user +- user_agent +- src +- vendor_account +- vendor_region +- vendor_product \ No newline at end of file diff --git a/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml new file mode 100644 index 0000000000..1a5ebc77e9 --- /dev/null +++ b/data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml @@ -0,0 +1,132 @@ +name: AWS CloudTrail DeleteModelInvocationLoggingConfiguration +id: fe2b3a52-1c8d-4e17-9f74-76c531a87e21 +version: 1 +date: '2023-10-15' +author: Bhavin Patel, Splunk +description: Logs an event when a model invocation logging configuration is deleted within the AWS CloudTrail. +mitre_components: +- Cloud Service Modification +source: aws_cloudtrail +sourcetype: aws:cloudtrail +separator: eventName +separator_value: DeleteModelInvocationLoggingConfiguration +supported_TA: +- name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 7.9.1 +fields: +- _time +- action +- app +- authentication_method +- awsRegion +- aws_account_id +- change_type +- command +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- desc +- dest +- dest_ip_range +- dest_port_range +- direction +- dvc +- errorCode +- errorMessage +- eventCategory +- eventID +- eventName +- eventSource +- eventTime +- eventType +- eventVersion +- eventtype +- host +- image_id +- index +- instance_type +- linecount +- managementEvent +- msg +- object +- object_attrs +- object_category +- object_id +- object_path +- product +- protocol +- protocol_code +- punct +- readOnly +- reason +- recipientAccountId +- region +- requestID +- requestParameters +- responseElements +- result +- result_id +- rule_action +- signature +- source +- sourceIPAddress +- sourcetype +- splunk_server +- splunk_server_group +- src +- src_ip +- src_ip_range +- src_port_range +- src_user +- src_user_id +- src_user_name +- src_user_role +- src_user_type +- start_time +- status +- tag +- tag::action +- tag::eventtype +- tag::object_category +- temp_access_key +- timeendpos +- timestartpos +- tlsDetails.cipherSuite +- tlsDetails.clientProvidedHostHeader +- tlsDetails.tlsVersion +- user +- userAgent +- userIdentity.accessKeyId +- userIdentity.accountId +- userIdentity.arn +- userIdentity.principalId +- userIdentity.type +- userIdentity.userName +- userName +- user_access_key +- user_agent +- user_arn +- user_group_id +- user_id +- user_name +- user_role +- user_type +- vendor +- vendor_account +- vendor_product +- vendor_region +example_log: '{"eventVersion": "1.09", "userIdentity": {"type": "IAMUser", "principalId": "AAAAAAA", "arn": "arn:aws:iam::111111111111:user/daftpunk", "accountId": "111111111111", "accessKeyId": "AKIAAAAAAAA", "userName": "daftpunk"}, "eventTime": "2025-04-03T17:16:02Z", "eventSource": "bedrock.amazonaws.com", "eventName": "DeleteModelInvocationLoggingConfiguration", "awsRegion": "us-west-2", "sourceIPAddress": "23.93.242.200", "userAgent": "aws-cli/2.24.22 md/awscrt#0.23.8 ua/2.1 os/macos#24.3.0 md/arch#arm64 lang/python#3.12.9 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#bedrock.delete-model-invocation-logging-configuration", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::111111111111:user/daftpunk is not authorized to perform: bedrock:DeleteModelInvocationLoggingConfiguration because no identity-based policy allows the bedrock:DeleteModelInvocationLoggingConfiguration action", "requestParameters": null, "responseElements": null, "requestID": "11519ac6-2761-4434-813a-585547a59096", "eventID": "1f7bd76f-13fb-4dff-b9bb-95a466217721", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "bedrock.us-west-2.amazonaws.com"}}' +output_fields: +- dest +- user +- user_agent +- src +- vendor_account +- vendor_region +- vendor_product \ No newline at end of file diff --git a/data_sources/aws_cloudtrail_invokemodel.yml b/data_sources/aws_cloudtrail_invokemodel.yml new file mode 100644 index 0000000000..1a83cfcd7b --- /dev/null +++ b/data_sources/aws_cloudtrail_invokemodel.yml @@ -0,0 +1,121 @@ +name: AWS CloudTrail InvokeModel +id: 5d92a1b6-3e78-4ff2-be83-7a4c01f9df6c +version: 1 +date: '2023-10-15' +author: Bhavin Patel, Splunk +description: Logs an event when a model is invoked within the AWS CloudTrail. +mitre_components: +- Cloud Service Usage +source: aws_cloudtrail +sourcetype: aws:cloudtrail +separator: eventName +separator_value: InvokeModel +supported_TA: +- name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 7.9.1 +fields: +- _time +- action +- app +- awsRegion +- aws_account_id +- change_type +- command +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- direction +- dvc +- errorCode +- eventCategory +- eventID +- eventName +- eventSource +- eventTime +- eventType +- eventVersion +- eventtype +- host +- index +- linecount +- managementEvent +- msg +- object_category +- product +- protocol +- protocol_code +- punct +- readOnly +- recipientAccountId +- region +- requestID +- requestParameters.modelId +- responseElements.requestId +- signature +- source +- sourceIPAddress +- sourcetype +- splunk_server +- src +- src_ip +- src_ip_range +- start_time +- status +- tag +- tag::eventtype +- timeendpos +- timestartpos +- user +- userAgent +- userIdentity.accessKeyId +- userIdentity.accountId +- userIdentity.arn +- userIdentity.principalId +- userIdentity.sessionContext.attributes.creationDate +- userIdentity.sessionContext.attributes.mfaAuthenticated +- userIdentity.sessionContext.sessionIssuer.accountId +- userIdentity.sessionContext.sessionIssuer.arn +- userIdentity.sessionContext.sessionIssuer.principalId +- userIdentity.sessionContext.sessionIssuer.type +- userIdentity.sessionContext.sessionIssuer.userName +- userIdentity.type +- userName +- user_access_key +- user_agent +- user_arn +- user_group_id +- user_id +- user_name +- user_type +- vendor +- vendor_account +- vendor_product +- vendor_region +example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": + "AROAIJIESMXKGCJRCTPR6:user@example.com", "arn": "arn:aws:sts::111111111111:assumed-role/admin_role/user@example.com", + "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLXXXXXXXX", "sessionContext": + {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": + "arn:aws:iam::111111111111:role/admin_role", "accountId": "111111111111", "userName": + "admin_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": + "false", "creationDate": "2023-10-15T08:36:15Z"}}}, "eventTime": "2023-10-15T08:49:49Z", + "eventSource": "bedrock.amazonaws.com", "eventName": "InvokeModel", "awsRegion": + "us-east-1", "sourceIPAddress": "192.0.2.1", "userAgent": "aws-cli/2.9.15", + "requestParameters": {"modelId": "anthropic.claude-v2"}, + "responseElements": {"requestId": "97b40da9-9291-4a92-8e9e-892b6887ffc9"}, + "requestID": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "eventID": + "46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": false, "eventType": "AwsApiCall", + "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +output_fields: +- dest +- user +- user_agent +- src +- vendor_account +- vendor_region +- vendor_product \ No newline at end of file diff --git a/data_sources/aws_cloudtrail_listfoundationmodels.yml b/data_sources/aws_cloudtrail_listfoundationmodels.yml new file mode 100644 index 0000000000..5ce2041eae --- /dev/null +++ b/data_sources/aws_cloudtrail_listfoundationmodels.yml @@ -0,0 +1,119 @@ +name: AWS CloudTrail ListFoundationModels +id: e7f31c68-84b9-4d21-a8c5-ec9d2fb3a457 +version: 1 +date: '2023-10-15' +author: Bhavin Patel, Splunk +description: Logs an event when a list of foundation models is requested within the AWS CloudTrail. +mitre_components: +- Cloud Service Discovery +source: aws_cloudtrail +sourcetype: aws:cloudtrail +separator: eventName +separator_value: ListFoundationModels +supported_TA: +- name: Splunk Add-on for AWS + url: https://splunkbase.splunk.com/app/1876 + version: 7.9.1 +fields: +- _time +- action +- app +- awsRegion +- aws_account_id +- change_type +- command +- date_hour +- date_mday +- date_minute +- date_month +- date_second +- date_wday +- date_year +- date_zone +- direction +- dvc +- errorCode +- eventCategory +- eventID +- eventName +- eventSource +- eventTime +- eventType +- eventVersion +- eventtype +- host +- index +- linecount +- managementEvent +- msg +- object_category +- product +- protocol +- protocol_code +- punct +- readOnly +- recipientAccountId +- region +- requestID +- responseElements.requestId +- signature +- source +- sourceIPAddress +- sourcetype +- splunk_server +- src +- src_ip +- src_ip_range +- start_time +- status +- tag +- tag::eventtype +- timeendpos +- timestartpos +- user +- userAgent +- userIdentity.accessKeyId +- userIdentity.accountId +- userIdentity.arn +- userIdentity.principalId +- userIdentity.sessionContext.attributes.creationDate +- userIdentity.sessionContext.attributes.mfaAuthenticated +- userIdentity.sessionContext.sessionIssuer.accountId +- userIdentity.sessionContext.sessionIssuer.arn +- userIdentity.sessionContext.sessionIssuer.principalId +- userIdentity.sessionContext.sessionIssuer.type +- userIdentity.sessionContext.sessionIssuer.userName +- userIdentity.type +- userName +- user_access_key +- user_agent +- user_arn +- user_group_id +- user_id +- user_name +- user_type +- vendor +- vendor_account +- vendor_product +- vendor_region +example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": + "AROAIJIESMXKGCJRCTPR6:user@example.com", "arn": "arn:aws:sts::111111111111:assumed-role/admin_role/user@example.com", + "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLXXXXXXXX", "sessionContext": + {"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn": + "arn:aws:iam::111111111111:role/admin_role", "accountId": "111111111111", "userName": + "admin_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated": + "false", "creationDate": "2023-10-15T08:36:15Z"}}}, "eventTime": "2023-10-15T08:49:49Z", + "eventSource": "bedrock.amazonaws.com", "eventName": "ListFoundationModels", "awsRegion": + "us-east-1", "sourceIPAddress": "192.0.2.1", "userAgent": "aws-cli/2.9.15", + "responseElements": {"requestId": "97b40da9-9291-4a92-8e9e-892b6887ffc9"}, + "requestID": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "eventID": + "46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": true, "eventType": "AwsApiCall", + "managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}' +output_fields: +- dest +- user +- user_agent +- src +- vendor_account +- vendor_region +- vendor_product \ No newline at end of file From eae0a4ed66268d2aea8a6c98201f4d6ae5e5f3f5 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Thu, 17 Apr 2025 14:49:05 -0700 Subject: [PATCH 10/10] updating spls to match with output from data sources --- detections/cloud/aws_bedrock_delete_guardrails.yml | 4 ++-- detections/cloud/aws_bedrock_delete_knowledge_base.yml | 7 +++---- ...rock_delete_model_invocation_logging_configuration.yml | 7 +++---- ...bedrock_high_number_list_foundation_model_failures.yml | 6 +++--- .../cloud/aws_bedrock_invoke_model_access_denied.yml | 8 ++++---- stories/aws_bedrock_security.yml | 7 +++---- 6 files changed, 18 insertions(+), 21 deletions(-) diff --git a/detections/cloud/aws_bedrock_delete_guardrails.yml b/detections/cloud/aws_bedrock_delete_guardrails.yml index 224daa7842..0b8a20b96b 100644 --- a/detections/cloud/aws_bedrock_delete_guardrails.yml +++ b/detections/cloud/aws_bedrock_delete_guardrails.yml @@ -7,11 +7,11 @@ status: production type: TTP description: The following analytic identifies attempts to delete AWS Bedrock GuardRails, which are security controls designed to prevent harmful, biased, or inappropriate AI outputs. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteGuardrail API. This activity is significant as it may indicate an adversary attempting to remove safety guardrails after compromising credentials, potentially to enable harmful or malicious model outputs. Removing guardrails could allow attackers to extract sensitive information, generate offensive content, or bypass security controls designed to prevent prompt injection and other AI-specific attacks. If confirmed malicious, this could represent a deliberate attempt to manipulate model behavior for harmful purposes. data_source: -- AWS CloudTrail +- AWS CloudTrail DeleteGuardrail search: >- `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteGuardrail | rename user_name as user - | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.guardrailIdentifier) as guardrailIds by src user user_agent vendor_account signature vendor_region + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.guardrailIdentifier) as guardrailIds by src user user_agent vendor_account vendor_product dest signature vendor_region | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_delete_guardrails_filter` diff --git a/detections/cloud/aws_bedrock_delete_knowledge_base.yml b/detections/cloud/aws_bedrock_delete_knowledge_base.yml index b53fab1f62..da7190e8b1 100644 --- a/detections/cloud/aws_bedrock_delete_knowledge_base.yml +++ b/detections/cloud/aws_bedrock_delete_knowledge_base.yml @@ -7,19 +7,18 @@ status: production type: TTP description: The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. It monitors AWS CloudTrail logs for DeleteKnowledgeBase API calls. This activity could indicate an adversary attempting to remove knowledge bases after compromising credentials, potentially to disrupt business operations or remove traces of data access. Deleting knowledge bases could impact model performance, remove critical business context, or be part of a larger attack to degrade AI capabilities. If confirmed malicious, this could represent a deliberate attempt to cause service disruption or data loss. data_source: -- AWS CloudTrail +- AWS CloudTrail DeleteKnowledgeBase search: >- `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteKnowledgeBase | rename user_name as user - | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.knowledgeBaseId) as knowledgeBaseIds by src user user_agent vendor_account signature vendor_region + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.knowledgeBaseId) as knowledgeBaseIds by src user user_agent vendor_account vendor_product dest signature vendor_region | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_delete_knowledge_base_filter` how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock Knowledge Base management events. known_false_positives: Legitimate administrators may delete Knowledge Bases as part of normal operations, such as when replacing outdated knowledge bases, removing test resources, or consolidating information. Consider implementing an allowlist for expected administrators who regularly manage Knowledge Base configurations. references: -- https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-bases.html -- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteKnowledgeBase.html +- https://www.sumologic.com/blog/defenders-guide-to-aws-bedrock/ - https://attack.mitre.org/techniques/T1562/ drilldown_searches: - name: View the detection results for - "$user$" diff --git a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml index 93724a15c7..4b7b827861 100644 --- a/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml +++ b/detections/cloud/aws_bedrock_delete_model_invocation_logging_configuration.yml @@ -7,19 +7,18 @@ status: production type: TTP description: The following analytic identifies attempts to delete AWS Bedrock model invocation logging configurations. It leverages AWS CloudTrail logs to detect when a user or service calls the DeleteModelInvocationLogging API. This activity is significant as it may indicate an adversary attempting to remove audit trails of model interactions after compromising credentials. Deleting model invocation logs could allow attackers to interact with AI models without leaving traces, potentially enabling them to conduct data exfiltration, prompt injection attacks, or other malicious activities without detection. If confirmed malicious, this could represent a deliberate attempt to hide unauthorized model usage and evade detection. data_source: -- AWS CloudTrail +- AWS CloudTrail DeleteModelInvocationLoggingConfiguration search: >- `cloudtrail` eventSource=bedrock.amazonaws.com eventName=DeleteModelInvocationLoggingConfiguration | rename user_name as user - | stats count min(_time) as firstTime max(_time) as lastTime by src user user_agent vendor_account signature vendor_region + | stats count min(_time) as firstTime max(_time) as lastTime by src user user_agent vendor_account vendor_product dest signature vendor_region | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_delete_model_invocation_logging_configuration_filter` how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. Ensure the CloudTrail is capturing Bedrock model invocation logging management events. known_false_positives: Legitimate administrators may delete model invocation logging configurations during maintenance, when updating logging policies, or when cleaning up unused resources. Consider implementing an allowlist for expected administrators who regularly manage logging configurations. references: -- https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring.html -- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteModelInvocationLogging.html +- https://www.sumologic.com/blog/defenders-guide-to-aws-bedrock/ - https://attack.mitre.org/techniques/T1562/008/ drilldown_searches: - name: View the detection results for - "$user$" diff --git a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml index e79b5a2bc2..a01000d0fd 100644 --- a/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml +++ b/detections/cloud/aws_bedrock_high_number_list_foundation_model_failures.yml @@ -10,7 +10,7 @@ data_source: - AWS CloudTrail search: >- `cloudtrail` eventSource=bedrock.amazonaws.com eventName=ListFoundationModels errorCode=AccessDenied | rename user_name as user - | stats count min(_time) as firstTime max(_time) as lastTime values(errorCode) as errorCodes values(errorMessage) as errorMessages by src user user_agent vendor_account signature vendor_region + | stats count min(_time) as firstTime max(_time) as lastTime values(errorCode) as errorCodes values(errorMessage) as errorMessages by src user user_agent vendor_account vendor_product dest signature vendor_region | where count > 9 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -18,8 +18,8 @@ search: >- how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. known_false_positives: Legitimate users may encounter multiple failures during permission testing, role transitions, or when service permissions are being reconfigured. High volumes of API errors may also occur during automated processes with misconfigured IAM policies or when new Bedrock features are being explored through API testing. references: -- https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html -- https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cloudtrail.html +- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListFoundationModels.html +- https://trustoncloud.com/blog/exposing-the-weakness-how-we-identified-a-flaw-in-bedrocks-foundation-model-access-control/ - https://attack.mitre.org/techniques/T1595/ drilldown_searches: - name: View the detection results for - "$user$" diff --git a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml index 7273fdf03a..1ca8d2354a 100644 --- a/detections/cloud/aws_bedrock_invoke_model_access_denied.yml +++ b/detections/cloud/aws_bedrock_invoke_model_access_denied.yml @@ -11,16 +11,16 @@ data_source: search: >- `cloudtrail` eventSource=bedrock.amazonaws.com eventName=InvokeModel errorCode=AccessDenied | rename user_name as user - | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.modelId) as modelIds by src user user_agent vendor_account signature vendor_region result result_id + | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.modelId) as modelIds by src user user_agent vendor_account vendor_product dest signature vendor_region result result_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_bedrock_invoke_model_access_denied_filter` how_to_implement: The Splunk AWS Add-on is required to utilize this data. The search requires AWS CloudTrail logs with Bedrock service events enabled. You must install and configure the AWS App for Splunk (version 6.0.0 or later) and Splunk Add-on for AWS (version 5.1.0 or later) to collect CloudTrail logs from AWS. known_false_positives: Legitimate users may encounter access denied errors during permission testing, role transitions, or when service permissions are being reconfigured. Access denials may also happen when automated processes are using outdated credentials or when new Bedrock features are being explored. references: -- https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html -- https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-cloudtrail.html -- https://attack.mitre.org/techniques/T1078/ +- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_ListFoundationModels.html +- https://trustoncloud.com/blog/exposing-the-weakness-how-we-identified-a-flaw-in-bedrocks-foundation-model-access-control/ +- https://attack.mitre.org/techniques/T1595/ drilldown_searches: - name: View the detection results for - "$user$" search: '%original_detection_search% | search user = "$user$"' diff --git a/stories/aws_bedrock_security.yml b/stories/aws_bedrock_security.yml index 4313af65ed..b735d765db 100644 --- a/stories/aws_bedrock_security.yml +++ b/stories/aws_bedrock_security.yml @@ -11,10 +11,9 @@ narrative: 'Organizations increasingly leverage Amazon Bedrock to power their Ge This Analytic Story includes detections that identify suspicious activities against AWS Bedrock services, such as access denied events, spikes in GuardRail blocks, unusual API call patterns, configuration changes to logging, and manipulation of model security controls. These detections help organizations monitor for potential compromise of their Bedrock environment and identify attempts to bypass AI security measures through configuration changes or abuse of legitimate functionality.' references: -- https://aws.amazon.com/bedrock/security/ -- https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam.html -- https://docs.aws.amazon.com/bedrock/latest/userguide/security-shared-responsibility.html -- https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html +- https://www.sumologic.com/blog/defenders-guide-to-aws-bedrock/ +- https://www.mitigant.io/en/blog/bedrock-or-bedsand-attacking-amazon-bedrocks-achilles-heel +- https://sysdig.com/blog/llmjacking-targets-deepseek/ tags: category: - Cloud Security