Detection rules › Sigma
AWS Bedrock Guardrail Updated
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses.
Known false positives
- Legitimate guardrail updates by authorized identities.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry coverage
Rules detecting the same action
These rules filter on the same operation.
Rule body
title: AWS Bedrock Guardrail Updated
id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f
status: experimental
description: |
Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
model safety controls and allow unsafe or unauthorized model responses.
references:
- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-07-10
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventName: 'UpdateGuardrail'
eventSource: 'bedrock.amazonaws.com'
condition: selection
falsepositives:
- Legitimate guardrail updates by authorized identities.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventName: 'UpdateGuardrail'
eventSource: 'bedrock.amazonaws.com'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventName | eq |
| field:"aws::eventName" kind:eq value:"UpdateGuardrail" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"bedrock.amazonaws.com" |