AWS Bedrock High Risk Filesystem or Execution Tool Invocation

  1[metadata]
  2creation_date = "2026/07/27"
  3integration = ["aws_bedrock"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects when a Bedrock model is prompted to invoke high-risk tools associated with shell execution, filesystem
 11operations, or process spawning. Adversaries may use compromised AI agent pipelines or manipulated prompts to
 12instruct the model to execute arbitrary system commands, read or write sensitive files, or spawn subprocesses —
 13extending the blast radius of a credential compromise or prompt injection attack.
 14"""
 15false_positives = [
 16    """
 17    Authorized AI agent workflows that include shell or filesystem tools may trigger this rule. Validate that the
 18    user identity and tool usage pattern are consistent with expected application behavior.
 19    """,
 20]
 21from = "now-60m"
 22interval = "10m"
 23language = "esql"
 24license = "Elastic License v2"
 25name = "AWS Bedrock High Risk Filesystem or Execution Tool Invocation"
 26note = """## Triage and analysis
 27
 28### Investigating AWS Bedrock High Risk Filesystem or Execution Tool Invocation
 29
 30This rule detects Bedrock model invocations where the prompt contains patterns associated with shell execution, filesystem access, or process spawning. These patterns may indicate a prompt injection attack, a compromised AI agent pipeline, or an insider attempting to use a Bedrock-backed application to execute unauthorized system operations.
 31
 32### Possible investigation steps
 33
 34- Review `gen_ai.prompt` to identify the specific tool invocation pattern that triggered the rule and determine whether it represents a legitimate tool call or a malicious instruction.
 35- Identify the user (`user.id`) and determine whether they are expected to interact with tools that perform filesystem or shell operations.
 36- Review the model ID (`gen_ai.request.model.id`) and the application context to understand whether shell or filesystem tools are part of the intended agent architecture.
 37- Correlate with other Bedrock invocation events from the same user in the preceding hour to assess whether this is an isolated event or part of a pattern.
 38- If the application uses Bedrock Agents, review the agent's configured action groups and Lambda functions to determine whether the tool invocation could have resulted in actual execution.
 39- Check for downstream evidence of execution: CloudTrail Lambda invocation events, SSM RunCommand, or EC2 activity correlated with the same time window.
 40
 41### False positive analysis
 42
 43- AI coding assistants and developer tools built on Bedrock may legitimately reference shell commands or file operations in their prompt templates.
 44- Security tooling that uses Bedrock to analyze shell scripts or code may produce prompts containing these patterns.
 45
 46### Response and remediation
 47
 48- If a prompt injection is confirmed, identify the injection source and remediate the input validation gap in the application layer.
 49- Review and restrict the tools available to the Bedrock Agent to the minimum required for its function.
 50- Apply Bedrock Guardrails to block or flag prompts containing high-risk tool invocation patterns.
 51- If credentials were compromised, rotate them immediately and audit all Bedrock and downstream API activity.
 52"""
 53references = [
 54    "https://docs.aws.amazon.com/bedrock/latest/userguide/agents-action-groups.html",
 55    "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html",
 56    "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
 57]
 58risk_score = 73
 59rule_id = "51d50385-aa3d-448c-bc48-7d6bc39108a3"
 60setup = """The AWS Bedrock integration must be enabled with model invocation logging configured to capture prompt
 61and completion content. Ensure `logs-aws_bedrock.invocation-*` is ingested into Elasticsearch."""
 62severity = "high"
 63tags = [
 64    "Domain: Cloud",
 65    "Domain: LLM",
 66    "Data Source: AWS Bedrock",
 67    "Use Case: Threat Detection",
 68    "Tactic: Execution",
 69    "Resources: Investigation Guide",
 70    "Noise: Unknown",
 71    "Performance: Fast",
 72    "Profile: Recommended",
 73    "Threat: Unauthorized AI Usage",
 74    "Rule Type: ES|QL",
 75    "Platform: AWS",
 76    "Domain: GenAI",
 77    "Service: AWS Bedrock",
 78]
 79timestamp_override = "event.ingested"
 80type = "esql"
 81
 82query = '''
 83from logs-aws_bedrock.invocation-* metadata _id, _version, _index
 84
 85| eval Esql.lowercase_prompt = TO_LOWER(gen_ai.prompt)
 86
 87| where
 88    Esql.lowercase_prompt like "*/bin/sh*" or
 89    Esql.lowercase_prompt like "*/bin/bash*" or
 90    Esql.lowercase_prompt like "*sh -c*" or
 91    Esql.lowercase_prompt like "*cmd.exe*" or
 92    Esql.lowercase_prompt like "*powershell*" or
 93    Esql.lowercase_prompt like "*exec(*" or
 94    Esql.lowercase_prompt like "*os.system*" or
 95    Esql.lowercase_prompt like "*subprocess*" or
 96    Esql.lowercase_prompt like "*python -c*" or
 97    Esql.lowercase_prompt like "*python3 -c*" or
 98    Esql.lowercase_prompt like "*curl *" or
 99    Esql.lowercase_prompt like "*wget *" or
100    Esql.lowercase_prompt like "*/dev/tcp/*" or
101    Esql.lowercase_prompt like "*nc -e*" or
102    Esql.lowercase_prompt like "*ncat *" or
103    Esql.lowercase_prompt like "*socat *" or
104    Esql.lowercase_prompt like "*openssl s_client*" or
105    Esql.lowercase_prompt like "*perl -e*" or
106    Esql.lowercase_prompt like "*ruby -e*" or
107    Esql.lowercase_prompt like "*php -r*" or
108    Esql.lowercase_prompt like "*node -e*" or
109    Esql.lowercase_prompt like "*base64 -d*" or
110    Esql.lowercase_prompt like "*bash -i*"
111
112| keep _id, _version, _index, @timestamp, user.id, cloud.account.id, gen_ai.request.model.id, gen_ai.prompt, gen_ai.completion
113'''
114
115[[rule.threat]]
116framework = "MITRE ATT&CK"
117
118[[rule.threat.technique]]
119id = "T1059"
120name = "Command and Scripting Interpreter"
121reference = "https://attack.mitre.org/techniques/T1059/"
122
123[rule.threat.tactic]
124id = "TA0002"
125name = "Execution"
126reference = "https://attack.mitre.org/tactics/TA0002/"
127
128[rule.alert_suppression]
129group_by = ["user.id", "cloud.account.id"]
130duration = {value = 1, unit = "h"}
131missing_fields_strategy = "suppress"
132
133[rule.investigation_fields]
134field_names = [
135    "@timestamp",
136    "user.id",
137    "cloud.account.id",
138    "gen_ai.request.model.id",
139    "gen_ai.prompt",
140    "gen_ai.completion",
141]