Classification:

attack

Tactic:

TA0005-defense-evasion

Technique:

T1578-modify-cloud-compute-infrastructure

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects creation of an Amazon Bedrock AgentCore Code Interpreter or Browser sandbox that is both attached to an IAM execution role and configured with a public network mode.

Strategy

This rule monitors CloudTrail management events for bedrock-agentcore.amazonaws.com where the event CreateCodeInterpreter or CreateBrowser occurs, @requestParameters.executionRoleArn is present, and @requestParameters.networkConfiguration.networkMode is PUBLIC.

AgentCore Code Interpreter and Browser sandboxes execute agent-generated code or drive automated web browsing on the caller’s behalf, and can be configured with an attached IAM execution role that grants the sandbox permissions to call other AWS services. Pairing that execution role with a PUBLIC network mode removes network-level containment, so a sandbox compromised through prompt injection, malicious tool output, or code-execution abuse could reach the public internet and pivot into other AWS resources using the attached role’s permissions.

Triage and response

• Examine {{@userIdentity.arn}} to determine who or what created the sandbox and whether that principal normally provisions AgentCore resources.
• Review {{@requestParameters.executionRoleArn}} to identify the permissions granted to the sandbox and assess the impact if the sandbox were compromised.
• Check the @requestParameters.networkConfiguration field to confirm the sandbox is configured for PUBLIC network access.
• Identify which sandbox type was created using (CreateCodeInterpreter or CreateBrowser) and review its intended use case with the owning team.
• Check user agent, geo-location information, and AWS region for unexpected tooling, source networks, or regions inconsistent with normal AgentCore administration.
• Review nearby IAM and STS activity involving the attached execution role to determine whether it has been used outside the sandbox’s expected scope.