Lacey Cochrane
@NullVectorXUSTrusted contributorCompletionist
11 followers143 downloads2,343 copies55 likes67,608 views
232 detections
Filters
Last updated
All Time
Detection languages
232
Categories
66
60
54
27
26
Platforms
81
53
36
26
22
Products / Services
30
26
23
21
19
MITRE Techniques
77
68
45
42
40
CVEs
4
4
Detects repeated occurrences of 'ValidationException' errors in AWS Bedrock 'InvokeModel' and 'Converse' API calls. This activity is indicative of an attacker attempting to probe or validate the usability of stolen AWS credentials by sending deliberately malformed requests, aiming to confirm successful authentication without triggering common access-related alerts.
Detects anomalous or potentially malicious LDAP queries on Domain Controllers, utilizing Event ID 1644 to monitor query filters. The rule identifies patterns commonly associated with reconnaissance and enumeration activities, including Kerberoasting (SPN enumeration), AS-REP roasting, delegation abuse, Active Directory Certificate Services (AD CS) enumeration, BloodHound collection, and bulk user, group, or computer discovery.
Detects anomalous AWS Bedrock model invocation patterns where a single identity accesses models across three or more distinct AWS regions within a short timeframe. This behavior is indicative of quota evasion, where attackers bypass per-region rate limits to maximize throughput when leveraging compromised credentials for unauthorized LLM use.
Detects the use of the RpcRemoteFindFirstPrinterChangeNotificationEx function (opnum 58) on the Spoolss RPC interface. This function can be abused by attackers to coerce the Print Spooler service into authenticating against an attacker-controlled host via SMB, a technique commonly referred to as 'PrinterBug' or 'SpoolSample'. This authentication can subsequently be relayed to other services (such as AD CS or LDAP) to achieve privilege escalation.
Detects unauthorized modification or deletion of AWS Bedrock model invocation logging configurations. Adversaries may use this technique to disable visibility into LLM usage or redirect logs to an attacker-controlled storage location to hide subsequent malicious activity.
This rule monitors for known suspicious RPC interface and function calls indicative of post-exploitation activities. It specifically targets RPC patterns used for lateral movement (e.g., PsExec, wmiexec, dcomexec), authentication coercion (e.g., PetitPotam, PrinterBug), and credential theft (e.g., DCSync, SAMR enumeration) by filtering on specific interface UUIDs and operation numbers.
Detects anomalous access to AWS Bedrock Knowledge Bases, identifying a pattern of initial reconnaissance (enumerating bases and data sources) followed by high-volume querying (Retrieve/RetrieveAndGenerate). This sequence is indicative of an attacker attempting to map out backend storage configurations and subsequently exfiltrate indexed document content.
Detects unauthorized modification or deletion of AWS Bedrock guardrails. Adversaries may delete or degrade these guardrails (lowering sensitivity to 'NONE' or 'LOW') to bypass content filters, PII redaction, and safety controls, enabling toxic output generation or data exfiltration via LLM applications.
Detects the use of long-lived AWS IAM access keys (AKIA) to perform critical AWS Bedrock operations such as enabling foundation model access (PutUseCaseForModelAccess, CreateFoundationModelAgreement). Such sensitive configurations are typically expected to be performed via the AWS Console using federated credentials; the use of long-lived keys for these specific actions is a strong indicator of potential compromise and unauthorized resource enablement.
Detects unauthorized modifications to AWS Bedrock Agent configurations, specifically identifying high-risk activities such as rewriting system prompts for potential prompt injection or attaching cross-account Lambda functions. The rule monitors for UpdateAgent, CreateAgentActionGroup, UpdateAgentActionGroup, and PrepareAgent events.
Page 3 of 24