AWS Bedrock Guardrail Deleted

calendar Jul 27, 2026 · attack.defense-impairment attack.t1685  ·
Share on: linkedin copy

Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses.

Sigma rule (View on GitHub)

 1title: AWS Bedrock Guardrail Deleted
 2id: 59b70e4d-dd17-44a9-b740-acf07ae3eb6a
 3status: experimental
 4description: |
 5    Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
 6    model safety controls and allow unsafe or unauthorized model responses.    
 7references:
 8    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html
 9author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
10date: 2026-07-10
11tags:
12    - attack.defense-impairment
13    - attack.t1685
14logsource:
15    product: aws
16    service: cloudtrail
17detection:
18    selection:
19        eventName: 'DeleteGuardrail'
20        eventSource: 'bedrock.amazonaws.com'
21    condition: selection
22falsepositives:
23    - Legitimate guardrail deletion by authorized identities.
24level: medium

References

Related rules

to-top