AWS IAM and account discovery after GetCallerIdentity and Bedrock listing LLM
Detects a sequence of AWS API calls where an external IP first calls sts:GetCallerIdentity, followed by Bedrock model listing APIs, and subsequently IAM or account/trail discovery events within a short timeframe, indicating potential cloud reconnaissance or unauthorized access.
Microsoft Sentinel (KQL)
