huntrule

Suspicious AWS Bedrock Guardrail Updated (via cloudtrail)

This rule detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and enable unsafe or unauthorized model responses.

SigmamediumCloudv1
sigma
title: Suspicious AWS Bedrock Guardrail Updated (via cloudtrail)
id: 4c6ed802-a34f-53eb-8660-18e39d4c9599
status: stable
description: This rule detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and enable unsafe or unauthorized model responses.
references:
    - https://attack.mitre.org/techniques/T1685/
    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
author: Huntrule Team
date: 2026-06-05
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'UpdateGuardrail'
        eventSource: 'bedrock.amazonaws.com'
    condition: selection
falsepositives:
    - Unknown
level: medium

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.