AWS Bedrock AgentCore Execution Role Used Outside Its Runtime

  1[metadata]
  2creation_date = "2026/07/08"
  3integration = ["aws"]
  4maturity = "production"
  5updated_date = "2026/07/08"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies an Amazon Bedrock AgentCore execution role (an AssumedRole identity whose role name begins with
 11"AgentCore-" or contains "BedrockAgentCore") making an AWS API call to a service it has not previously called. AgentCore runtimes normally interact
 12only with Bedrock inference, AgentCore data-plane, and observability services (CloudWatch Logs, X-Ray, CloudWatch
 13metrics), so an execution role suddenly calling STS, EC2, IAM,
 14Secrets Manager, or other services is a strong indicator that the role's temporary credentials were exfiltrated from
 15the agent's microVM (for example, via the Code Interpreter instance-metadata-service credential theft) and are being
 16used outside the runtime for reconnaissance, privilege escalation, or lateral movement. Because the stolen credentials
 17are recorded in CloudTrail under the execution role's own identity, the anomalous service usage, not the identity, is
 18the detectable signal.
 19"""
 20false_positives = [
 21    """
 22    An AgentCore agent that legitimately integrates with additional AWS services will produce a first-time service call
 23    for its execution role. Verify the role in
 24    "aws.cloudtrail.user_identity.session_context.session_issuer.arn", the action in "event.action" and "event.provider",
 25    and the origin in "source.ip" and "source.as.organization.name", and confirm the activity matches the agent's
 26    intended design. Known agent integrations can be excluded after validation.
 27    """,
 28]
 29from = "now-9m"
 30index = ["logs-aws.cloudtrail-*"]
 31language = "kuery"
 32license = "Elastic License v2"
 33name = "AWS Bedrock AgentCore Execution Role Used Outside Its Runtime"
 34note = """## Triage and analysis
 35
 36### Investigating AWS Bedrock AgentCore Execution Role Used Outside Its Runtime
 37
 38AgentCore runtime and tool execution roles are assumed by the AgentCore service and normally only call Bedrock inference, AgentCore data-plane, and observability (CloudWatch Logs, X-Ray, CloudWatch metrics) APIs, all of which this rule excludes. Public research has shown the Code Interpreter microVM exposes the execution role's temporary credentials through the instance metadata service (IMDS), and that a string-filter bypass allows exfiltrating them outside the sandbox. Once stolen, the credentials are used to call other AWS services, but those calls are logged in CloudTrail under the execution role's identity rather than the attacker's, creating an attribution gap. This rule flags the first time an AgentCore execution role ("AgentCore-*" or "*BedrockAgentCore*") calls a non-Bedrock service, which is the point at which exfiltrated credentials are put to use.
 39
 40### Possible investigation steps
 41
 42- Identify the execution role in "aws.cloudtrail.user_identity.session_context.session_issuer.arn" and map it to its AgentCore runtime, gateway, or code interpreter.
 43- Review "event.provider" and "event.action" for reconnaissance (sts:GetCallerIdentity, ec2:Describe*, iam:List*/Get*), privilege escalation (sts:AssumeRole, iam:Put*/Attach*), or data access, and assess what the role can reach.
 44- Compare "source.ip", "source.as.organization.name", and "user_agent.original" against the AgentCore service origin; calls from an external network strongly indicate exfiltrated credentials.
 45- Determine whether the agent design legitimately added this integration, or whether the activity is unexpected for the role.
 46
 47### False positive analysis
 48
 49- A newly designed agent integration produces a first-time non-Bedrock call for its execution role. Confirm the integration is approved and exclude the role and service after validation.
 50
 51### Response and remediation
 52
 53- If unauthorized, revoke the execution role's active sessions, rotate any associated secrets, and review every action the role took since the first anomalous call.
 54- Restrict the execution role to least privilege, prefer VPC network mode for code interpreters, and ensure the metadata service requires session tokens.
 55"""
 56references = [
 57    "https://sonraisecurity.com/blog/sandboxed-to-compromised-new-research-exposes-credential-exfiltration-paths-in-aws-code-interpreters/",
 58    "https://unit42.paloaltonetworks.com/bypass-of-aws-sandbox-network-isolation-mode/",
 59]
 60risk_score = 73
 61rule_id = "ee066db8-4f2f-42d3-8ebd-ea25cd9bdc73"
 62setup = "This rule requires AWS CloudTrail logs ingested via the Elastic AWS integration. See https://docs.elastic.co/integrations/aws/cloudtrail for setup details. The AgentCore execution-role name prefix may differ in your environment; tune the role-name filter accordingly."
 63severity = "high"
 64tags = [
 65    "Domain: Cloud",
 66    "Data Source: AWS",
 67    "Data Source: AWS CloudTrail",
 68    "Data Source: Amazon Web Services",
 69    "Data Source: Amazon Bedrock",
 70    "Use Case: Threat Detection",
 71    "Tactic: Privilege Escalation",
 72    "Tactic: Credential Access",
 73    "Resources: Investigation Guide",
 74]
 75timestamp_override = "event.ingested"
 76type = "new_terms"
 77
 78query = '''
 79data_stream.dataset: "aws.cloudtrail"
 80    and aws.cloudtrail.user_identity.type: "AssumedRole"
 81    and aws.cloudtrail.user_identity.session_context.session_issuer.arn: (*role/AgentCore-* or *role/*BedrockAgentCore*)
 82    and event.outcome: "success"
 83    and not event.provider: (
 84        "bedrock.amazonaws.com" or
 85        "bedrock-runtime.amazonaws.com" or
 86        "bedrock-agentcore.amazonaws.com" or
 87        "bedrock-agentcore-control.amazonaws.com" or
 88        "logs.amazonaws.com" or
 89        "xray.amazonaws.com" or
 90        "monitoring.amazonaws.com" or
 91        "ecr.amazonaws.com" or
 92        "ecr-public.amazonaws.com"
 93    )
 94'''
 95
 96
 97[[rule.threat]]
 98framework = "MITRE ATT&CK"
 99[[rule.threat.technique]]
100id = "T1078"
101name = "Valid Accounts"
102reference = "https://attack.mitre.org/techniques/T1078/"
103[[rule.threat.technique.subtechnique]]
104id = "T1078.004"
105name = "Cloud Accounts"
106reference = "https://attack.mitre.org/techniques/T1078/004/"
107
108
109[rule.threat.tactic]
110id = "TA0004"
111name = "Privilege Escalation"
112reference = "https://attack.mitre.org/tactics/TA0004/"
113[[rule.threat]]
114framework = "MITRE ATT&CK"
115[[rule.threat.technique]]
116id = "T1552"
117name = "Unsecured Credentials"
118reference = "https://attack.mitre.org/techniques/T1552/"
119[[rule.threat.technique.subtechnique]]
120id = "T1552.005"
121name = "Cloud Instance Metadata API"
122reference = "https://attack.mitre.org/techniques/T1552/005/"
123
124
125[rule.threat.tactic]
126id = "TA0006"
127name = "Credential Access"
128reference = "https://attack.mitre.org/tactics/TA0006/"
129
130[rule.investigation_fields]
131field_names = [
132    "@timestamp",
133    "user_agent.original",
134    "source.ip",
135    "source.as.number",
136    "source.as.organization.name",
137    "aws.cloudtrail.user_identity.session_context.session_issuer.arn",
138    "aws.cloudtrail.user_identity.arn",
139    "aws.cloudtrail.user_identity.type",
140    "event.provider",
141    "event.action",
142    "event.outcome",
143    "cloud.account.id",
144    "cloud.region",
145    "aws.cloudtrail.request_parameters",
146]
147
148[rule.new_terms]
149field = "new_terms_fields"
150value = ["aws.cloudtrail.user_identity.session_context.session_issuer.arn", "event.provider"]
151[[rule.new_terms.history_window_start]]
152field = "history_window_start"
153value = "now-7d"