AWS Bedrock Guardrail Updated

calendar Jul 27, 2026 · attack.defense-impairment attack.t1685  ·
Share on: linkedin copy

Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses.

Sigma rule (View on GitHub)

 1title: AWS Bedrock Guardrail Updated
 2id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f
 3status: experimental
 4description: |
 5    Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
 6    model safety controls and allow unsafe or unauthorized model responses.    
 7references:
 8    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
 9author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
10date: 2026-07-10
11tags:
12    - attack.defense-impairment
13    - attack.t1685
14logsource:
15    product: aws
16    service: cloudtrail
17detection:
18    selection:
19        eventName: 'UpdateGuardrail'
20        eventSource: 'bedrock.amazonaws.com'
21    condition: selection
22falsepositives:
23    - Legitimate guardrail updates by authorized identities.
24level: medium

References

Related rules

to-top