Classification:

attack

Tactic:

TA0007-discovery

Technique:

T1526-cloud-service-discovery

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects Amazon Bedrock activity listing available models across multiple AWS regions using a long-term access key. Alerts when a principal enumerates available models in several regions in a short window.

Strategy

This rule monitors ListFoundationModels calls to bedrock.amazonaws.com and ListModels calls to bedrock-mantle.amazonaws.com that originate from a long-term access key. These APIs return the foundation models available in the targeted region, which is a common first step in LLMjacking reconnaissance.

Triage and response

• Verify whether {{@ocsf.actor.user.uid}} is expected to enumerate Bedrock models, and whether that work is limited to a known set of regions.
• Identify the regions in @ocsf.cloud.region for this signal and determine whether a legitimate workload would query the catalog in all of them.
• Review the access key {{@ocsf.actor.user.credential_uid}} to confirm it is a long-term key that should still exist, and check for recent creation, rotation, or unexpected use.
• Examine the source IP {{@network.client.ip}} and determine whether it matches expected infrastructure for this identity.
• Check follow-on Bedrock activity from the same principal, including InvokeModel, Converse, and quota-increase requests, for progression beyond discovery.