AWS Bedrock High-Frequency Single-Model Inference API Probing

  1[metadata]
  2creation_date = "2026/06/05"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/09/25"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an AWS principal performing a high volume of Amazon Bedrock inference API calls against a single model within
 11a short window. Membership inference attacks require hundreds to thousands of statistically similar queries whose
 12prompts and responses are intentionally content-benign, making guardrail- and content-based rules ineffective. This rule
 13detects the high-frequency single-model probing pattern that precedes membership inference and related exfiltration via
 14the inference API. It is a behavioral / volumetric precursor: it does not observe model confidence scores and a fixed
 15call-count threshold only catches the loud variant, so paced, low-and-slow, or credential-distributed probing will evade
 16it. Definitive membership inference detection requires ML anomaly analysis over per-entity inference-rate and
 17response-distribution baselines.
 18"""
 19false_positives = [
 20    """
 21    Automated agents, chat applications, retrieval-augmented generation services, evaluation pipelines, and load tests
 22    routinely generate high Bedrock inference volume against one model and will exceed any fixed threshold. Validate the
 23    principal, user agent, source IP, and application context before treating the activity as malicious, and tune the
 24    threshold to the deployment.
 25    """,
 26]
 27from = "now-60m"
 28interval = "10m"
 29language = "esql"
 30license = "Elastic License v2"
 31name = "AWS Bedrock High-Frequency Single-Model Inference API Probing"
 32note = """## Triage and analysis
 33
 34### Investigating AWS Bedrock High-Frequency Single-Model Inference API Probing
 35
 36Membership inference compares many samples against a model to infer whether specific records were present in training data. Because prompts and responses often appear benign, the actionable signal is frequently statistical: unusually high inference rates concentrated on one model from a single principal. AWS CloudTrail records the core Bedrock runtime operations (`InvokeModel`, `InvokeModelWithResponseStream`, `Converse`, `ConverseStream`) as management events, which are logged by default, so this probing phase is observable at the API layer even when Bedrock model invocation logging is disabled. CloudTrail does not capture the prompt body, so this rule is purely volumetric.
 37
 38This rule is tuned to the loud case. Treat it as corroborating signal alongside other Bedrock alerts, not as conclusive membership inference detection.
 39
 40#### Possible investigation steps
 41
 42- Identify the principal in `aws.cloudtrail.user_identity.arn` and the targeted model in the extracted `Esql.model_id`.
 43- Determine whether the call volume exceeds the principal's historical baseline for the same model.
 44- Review companion Bedrock invocation logs, if enabled, for short prompts, repeated inputs, or low-variance responses that may indicate membership testing.
 45- Inspect `Esql.source_ip_values`, `Esql.user_agent_original_values`, and recent IAM activity for signs of compromised credentials or unexpected automation.
 46- Correlate with bulk output-extraction or guardrail alerts that may indicate a broader inference abuse campaign.
 47
 48### Response and remediation
 49
 50- Apply Bedrock service quotas and IAM least privilege for inference APIs while investigating.
 51- Enable model invocation logging for content-level review if not already configured.
 52- If abuse is confirmed, rotate access keys or disable the compromised principal.
 53"""
 54references = [
 55    "https://atlas.mitre.org/techniques/AML.T0024",
 56    "https://atlas.mitre.org/techniques/AML.T0024.000",
 57    "https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html",
 58    "https://www.elastic.co/security-labs/elastic-advances-llm-security",
 59]
 60risk_score = 47
 61rule_id = "56312ef5-656c-4bf7-ad9a-affed052b102"
 62setup = """## Setup
 63
 64This rule requires AWS CloudTrail management events for Amazon Bedrock and ingestion via the AWS
 65integration (`aws.cloudtrail` data stream). The core Bedrock runtime operations are logged as management
 66events by default; no Bedrock model invocation logging is required.
 67
 68"""
 69severity = "medium"
 70tags = [
 71    "Domain: Cloud",
 72    "Domain: GenAI",
 73    "Data Source: AWS",
 74    "Data Source: Amazon Web Services",
 75    "Data Source: AWS CloudTrail",
 76    "Use Case: Threat Detection",
 77    "Tactic: Exfiltration",
 78    "Resources: Investigation Guide",
 79    "Noise: Medium",
 80    "Performance: Fast",
 81    "Profile: Recommended",
 82    "Threat: Unauthorized AI Usage",
 83    "Threat: LLMjacking",
 84    "Rule Type: ES|QL",
 85    "Platform: AWS",
 86    "Service: AWS Bedrock",
 87    "Mitre Atlas: AML.T0024",
 88    "Mitre Atlas: AML.T0024.000",
 89]
 90timestamp_override = "event.ingested"
 91type = "esql"
 92
 93query = '''
 94FROM logs-aws.cloudtrail-*
 95| WHERE event.provider == "bedrock.amazonaws.com"
 96    AND event.action IN (
 97      "InvokeModel",
 98      "Converse",
 99      "ConverseStream",
100      "InvokeModelWithResponseStream"
101    )
102    AND event.outcome == "success"
103    AND aws.cloudtrail.user_identity.arn IS NOT NULL
104    AND aws.cloudtrail.request_parameters IS NOT NULL
105| GROK aws.cloudtrail.request_parameters """modelId=(?<Esql.model_id>[^,}\]]+)"""
106| WHERE Esql.model_id IS NOT NULL
107| STATS
108    Esql.inference_call_count = COUNT(*),
109    Esql.timestamp_min = MIN(@timestamp),
110    Esql.timestamp_max = MAX(@timestamp),
111    Esql.event_ingested_min = MIN(event.ingested),
112    Esql.event_ingested_max = MAX(event.ingested),
113    Esql.event_action_values = VALUES(event.action),
114    Esql.source_ip_values = VALUES(source.ip),
115    Esql.source_as_organization_name_values =
116      VALUES(source.as.organization.name),
117    Esql.source_geo_country_iso_code_values =
118      VALUES(source.geo.country_iso_code),
119    Esql.source_geo_city_name_values =
120      VALUES(source.geo.city_name),
121    Esql.user_name_values = VALUES(user.name),
122    Esql.user_agent_original_values = VALUES(user_agent.original),
123    Esql.aws_cloudtrail_user_identity_type_values =
124      VALUES(aws.cloudtrail.user_identity.type),
125    Esql.aws_cloudtrail_user_identity_access_key_id_values =
126      VALUES(aws.cloudtrail.user_identity.access_key_id),
127    Esql.session_issuer_arn_values =
128      VALUES(aws.cloudtrail.user_identity.session_context.session_issuer.arn),
129    Esql.cloud_region_values = VALUES(cloud.region),
130    Esql.data_stream_namespace_values = VALUES(data_stream.namespace)
131  BY aws.cloudtrail.user_identity.arn,
132     cloud.account.id,
133     Esql.model_id
134| WHERE Esql.inference_call_count >= 500
135| KEEP
136    aws.cloudtrail.user_identity.arn,
137    cloud.account.id,
138    Esql.*
139| sort Esql.inference_call_count desc
140'''
141
142
143[[rule.threat_mappings]]
144framework = "MITRE ATLAS"
145version = "2026.08"
146[[rule.threat_mappings.threat]]
147framework = "MITRE ATLAS"
148[[rule.threat_mappings.threat.technique]]
149id = "AML.T0024"
150name = "Exfiltration via AI Inference API"
151reference = "https://atlas.mitre.org/techniques/AML.T0024/"
152[[rule.threat_mappings.threat.technique.subtechnique]]
153id = "AML.T0024.000"
154name = "Infer Training Data Membership"
155reference = "https://atlas.mitre.org/techniques/AML.T0024.000/"
156
157
158
159[rule.threat_mappings.threat.tactic]
160id = "AML.TA0010"
161name = "Exfiltration"
162reference = "https://atlas.mitre.org/tactics/AML.TA0010/"
163
164[rule.alert_suppression]
165group_by = ["aws.cloudtrail.user_identity.arn", "cloud.account.id"]
166missing_fields_strategy = "suppress"
167
168[rule.investigation_fields]
169field_names = [
170    "aws.cloudtrail.user_identity.arn",
171    "cloud.account.id",
172    "Esql.model_id",
173    "Esql.inference_call_count",
174    "Esql.user_agent_original_values",
175    "Esql.source_ip_values",
176    "Esql.user_name_values",
177]
178
179[rule.alert_suppression.duration]
180unit = "m"
181value = 60