Classification:

attack

Tactic:

TA0003-persistence

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detects successful Amazon Bedrock InvokeModel or InvokeModelWithResponseStream calls from a previously unseen ASN for a model per the model ID number.

Strategy

This rule monitors successful InvokeModel and InvokeModelWithResponseStream calls to bedrock.amazonaws.com and tracks @network.client.geoip.as.number together with @ocsf.api.request.data.modelId for each identity. InvokeModel is the raw Bedrock runtime API used to send prompts and receive completions.

A principal that suddenly invokes a new model from a new autonomous system can indicate stolen-credential abuse or LLMjacking, where attackers monetize victim AWS accounts by running inference.

Triage and response

• Verify whether {{@ocsf.actor.user.uid}} is expected to call Bedrock InvokeModel from ASN {{@network.client.geoip.as.number}} using model {{@ocsf.api.request.data.modelId}}.
• Identify the source IP {{@network.client.ip}} and determine whether it belongs to known corporate, cloud-provider, or VPN infrastructure for this identity.
• Review other Bedrock runtime activity from the same identity, including additional InvokeModel calls and any Converse usage, for unusual volume or model shopping.
• Check recent IAM and STS activity for {{@ocsf.actor.user.uid}}, such as access-key creation, password resets, or AssumeRole, that would indicate credential theft.
• Determine whether {{@ocsf.api.request.data.modelId}} is an approved model for this workload and whether the identity has a documented reason to adopt it.