Detection rules › Sigma

AWS Bedrock Guardrail Updated

Status
experimental
Severity
medium
Log source
product aws, service cloudtrail
Author
Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Source
github.com/SigmaHQ/sigma

Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses.

Known false positives

  • Legitimate guardrail updates by authorized identities.

MITRE ATT&CK coverage

TacticTechniques
Defense Impairment

Telemetry coverage

Rules detecting the same action

These rules filter on the same operation.

Rule body

title: AWS Bedrock Guardrail Updated
id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f
status: experimental
description: |
    Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
    model safety controls and allow unsafe or unauthorized model responses.
references:
    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-07-10
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'UpdateGuardrail'
        eventSource: 'bedrock.amazonaws.com'
    condition: selection
falsepositives:
    - Legitimate guardrail updates by authorized identities.
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    eventName: 'UpdateGuardrail'
    eventSource: 'bedrock.amazonaws.com'

Indicators

These rows show field, operator, and value matches.