AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered

  1[metadata]
  2creation_date = "2026/06/04"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/06/04"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when an AWS Bedrock custom model is imported or deployed, or when a marketplace model endpoint is created or
 11registered, via the CreateModelImportJob, CreateCustomModelDeployment, CreateMarketplaceModelEndpoint, or
 12RegisterMarketplaceModelEndpoint API calls. These actions introduce a model artifact from outside the organization's
 13trusted training and approval pipeline. A backdoored, poisoned, or attacker-supplied model that downstream applications
 14subsequently invoke represents a software supply-chain compromise. New model imports and marketplace endpoint
 15registrations should be validated for artifact provenance (S3 source ownership), the registering identity, and whether
 16the model originates from an approved internal pipeline.
 17"""
 18false_positives = [
 19    """
 20    Machine learning engineers, MLOps automation, or platform teams may legitimately import custom models or stand up
 21    marketplace model endpoints as part of normal model lifecycle operations. Verify whether the user identity, user
 22    agent, source IP, and model artifact source (S3 location) are expected for your environment. Imports performed by
 23    approved CI/CD or IaC pipelines can be exempted from this rule. Activity from unfamiliar identities or untrusted
 24    artifact sources should be investigated.
 25    """,
 26]
 27from = "now-6m"
 28index = ["logs-aws.cloudtrail-*"]
 29language = "kuery"
 30license = "Elastic License v2"
 31name = "AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered"
 32note = """## Triage and analysis
 33
 34### Investigating AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered
 35
 36Amazon Bedrock allows organizations to import custom models, deploy them, and register marketplace model endpoints for inference. Each of these paths introduces a model artifact that did not necessarily originate from the organization's trusted training and approval pipeline. Adversaries who can import a backdoored or poisoned model — or register an untrusted marketplace endpoint — can influence the output of any downstream application that invokes that model, constituting a supply-chain compromise. This detection identifies `CreateModelImportJob`, `CreateCustomModelDeployment`, `CreateMarketplaceModelEndpoint`, and `RegisterMarketplaceModelEndpoint` calls so responders can verify model provenance before the model is trusted for inference.
 37
 38#### Possible investigation steps
 39
 40- **Identify the actor and context**
 41  - Review `aws.cloudtrail.user_identity.arn`, `aws.cloudtrail.user_identity.type`, `aws.cloudtrail.user_identity.access_key_id`, `user_agent.original`, and `source.ip`.
 42  - Confirm whether a related change request or model onboarding ticket exists.
 43  - Determine if the identity is an approved ML/MLOps role or automation principal.
 44- **Validate the model artifact source**
 45  - In `aws.cloudtrail.flattened.request_parameters`, review the model source location (e.g., the S3 URI for an import job) and confirm the bucket belongs to your organization and is not attacker-controlled.
 46  - For marketplace endpoints, confirm the model package ARN / product corresponds to an approved vendor.
 47- **Correlate activity**
 48  - Look for subsequent `InvokeModel` / `InvokeModelWithResponseStream` activity targeting the new model or endpoint.
 49  - Check for prior enumeration such as `ListFoundationModels`, `ListCustomModels`, or `ListImportedModels`.
 50  - Review other recent actions by the same identity for signs of broader compromise.
 51
 52### False positive analysis
 53- **Planned model onboarding**: ML teams routinely import models and register endpoints. Validate against a ticket and confirm the artifact source.
 54- **Automation**: IaC or MLOps pipelines may create these resources during deployment. Confirm the source IP and ARN match expected automation infrastructure.
 55
 56### Response and remediation
 57- **If unauthorized**
 58  - Delete or disable the imported model, custom model deployment, or marketplace endpoint.
 59  - Prevent downstream applications from invoking the untrusted model until provenance is established.
 60  - Disable the access key in `aws.cloudtrail.user_identity.access_key_id` and rotate credentials if compromise is suspected.
 61  - Audit the S3 source bucket for tampering and review the model artifact for backdoors.
 62- **Hardening**
 63  - Restrict `bedrock:CreateModelImportJob`, `bedrock:CreateCustomModelDeployment`, and marketplace endpoint creation/registration permissions to approved roles.
 64  - Enforce that model artifacts originate only from organization-owned, controlled S3 locations.
 65
 66### Additional information
 67
 68"""
 69references = [
 70    "https://docs.aws.amazon.com/bedrock/latest/APIReference/API_CreateModelImportJob.html",
 71    "https://docs.aws.amazon.com/bedrock/latest/userguide/model-import.html"
 72]
 73risk_score = 47
 74rule_id = "c435defe-8438-4d5a-b4d0-86ab0faf9a49"
 75severity = "medium"
 76tags = [
 77    "Domain: Cloud",
 78    "Domain: LLM",
 79    "Data Source: AWS",
 80    "Data Source: AWS CloudTrail",
 81    "Data Source: Amazon Web Services",
 82    "Data Source: Amazon Bedrock",
 83    "Use Case: Threat Detection",
 84    "Resources: Investigation Guide",
 85    "Tactic: Persistence",
 86]
 87timestamp_override = "event.ingested"
 88type = "query"
 89
 90query = '''
 91data_stream.dataset: "aws.cloudtrail"
 92    and event.provider: "bedrock.amazonaws.com"
 93    and event.action: (
 94        "CreateModelImportJob" or
 95        "CreateCustomModelDeployment" or
 96        "CreateMarketplaceModelEndpoint" or
 97        "RegisterMarketplaceModelEndpoint"
 98    )
 99    and event.outcome: "success"
100'''
101
102
103[[rule.threat]]
104framework = "MITRE ATT&CK"
105
106[[rule.threat.technique]]
107id = "T1525"
108name = "Implant Internal Image"
109reference = "https://attack.mitre.org/techniques/T1525/"
110
111[rule.threat.tactic]
112id = "TA0003"
113name = "Persistence"
114reference = "https://attack.mitre.org/tactics/TA0003/"
115
116[rule.investigation_fields]
117field_names = [
118    "@timestamp",
119    "user.name",
120    "user_agent.original",
121    "source.ip",
122    "aws.cloudtrail.user_identity.arn",
123    "aws.cloudtrail.user_identity.type",
124    "aws.cloudtrail.user_identity.access_key_id",
125    "event.action",
126    "event.provider",
127    "event.outcome",
128    "cloud.account.id",
129    "cloud.region",
130    "aws.cloudtrail.flattened.request_parameters",
131    "aws.cloudtrail.response_elements",
132]