Classification:

attack

Tactic:

TA0040-impact

Technique:

T1496-resource-hijacking

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects Amazon Bedrock service quota increase requests, with a higher-severity case when the requested value is the AWS maximum.

Strategy

This rule monitors RequestServiceQuotaIncrease calls to servicequotas.amazonaws.com where @ocsf.api.request.data.serviceCode is bedrock.

Quota increases raise the volume of inference an account can run, which attackers use to scale LLMjacking after they obtain AWS credentials.

A Medium case fires when the requested @ocsf.api.request.data.desiredValue is the maximum AWS allows. A Low case fires on any other Bedrock quota increase requests from the same identity.

Triage and response

• Verify whether {{@ocsf.actor.user.uid}} is authorized to request Bedrock quota changes in this account.
• Review the requested quota code and {{@ocsf.api.request.data.desiredValue}} to distinguish a routine capacity request from a maximum-limit request.
• Examine recent Bedrock runtime usage from the same identity, including InvokeModel and Converse, for a sudden spike that would motivate a quota increase.
• Identify the source IP {{@network.client.ip}} and determine whether it matches expected administrative locations for this principal.
• Check Service Quotas and Support activity from {{@ocsf.actor.user.uid}} for parallel limit-increase requests against other expensive services.