Stolen AWS role creds: GetCallerIdentity then Bedrock model listing (LLMjacking)
Detects a sequence where an assumed-role credential from an external IP calls sts:GetCallerIdentity followed by listing Amazon Bedrock foundation models within a one-hour window, potentially indicating reconnaissance of AI/ML services by an external threat actor.
Microsoft Sentinel (KQL)
