Suspicious Removal of AWS Bedrock Guardrail (via cloudtrail)

This rule detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and enable unsafe or unauthorized model responses.

SigmamediumCloudv1

sigma

suspicious-removal-of-aws-bedrock-guardrail-via-cloudtrail

title: Suspicious Removal of AWS Bedrock Guardrail (via cloudtrail)
id: 4ed0b45e-0b37-5b20-9440-58bb1dc8b4e9
status: stable
description: This rule detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and enable unsafe or unauthorized model responses.
references:
    - https://attack.mitre.org/techniques/T1685/
    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html
author: Huntrule Team
date: 2026-06-15
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'DeleteGuardrail'
        eventSource: 'bedrock.amazonaws.com'
    condition: selection
falsepositives:
    - Unknown
level: medium

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.