Loading

AWS Bedrock High Risk Filesystem or Execution Tool Invocation

Detects when a Bedrock model is prompted to invoke high-risk tools associated with shell execution, filesystem operations, or process spawning. Adversaries may use compromised AI agent pipelines or manipulated prompts to instruct the model to execute arbitrary system commands, read or write sensitive files, or spawn subprocesses — extending the blast radius of a credential compromise or prompt injection attack.

Rule type: esql
Rule indices:

Rule Severity: high
Risk Score: 73
Runs every: 10m
Searches indices from: now-60m
Maximum alerts per execution: 100
References:

Tags:

  • Domain: Cloud
  • Domain: LLM
  • Data Source: AWS Bedrock
  • Use Case: Threat Detection
  • Tactic: Execution
  • Resources: Investigation Guide

Version: 1
Rule authors:

  • Elastic

Rule license: Elastic License v2
The AWS Bedrock integration must be enabled with model invocation logging configured to capture prompt and completion content. Ensure logs-aws_bedrock.invocation-* is ingested into Elasticsearch.

This rule detects Bedrock model invocations where the prompt contains patterns associated with shell execution, filesystem access, or process spawning. These patterns may indicate a prompt injection attack, a compromised AI agent pipeline, or an insider attempting to use a Bedrock-backed application to execute unauthorized system operations.

  • Review gen_ai.prompt to identify the specific tool invocation pattern that triggered the rule and determine whether it represents a legitimate tool call or a malicious instruction.
  • Identify the user (user.id) and determine whether they are expected to interact with tools that perform filesystem or shell operations.
  • Review the model ID (gen_ai.request.model.id) and the application context to understand whether shell or filesystem tools are part of the intended agent architecture.
  • Correlate with other Bedrock invocation events from the same user in the preceding hour to assess whether this is an isolated event or part of a pattern.
  • If the application uses Bedrock Agents, review the agent's configured action groups and Lambda functions to determine whether the tool invocation could have resulted in actual execution.
  • Check for downstream evidence of execution: CloudTrail Lambda invocation events, SSM RunCommand, or EC2 activity correlated with the same time window.
  • AI coding assistants and developer tools built on Bedrock may legitimately reference shell commands or file operations in their prompt templates.
  • Security tooling that uses Bedrock to analyze shell scripts or code may produce prompts containing these patterns.
  • If a prompt injection is confirmed, identify the injection source and remediate the input validation gap in the application layer.
  • Review and restrict the tools available to the Bedrock Agent to the minimum required for its function.
  • Apply Bedrock Guardrails to block or flag prompts containing high-risk tool invocation patterns.
  • If credentials were compromised, rotate them immediately and audit all Bedrock and downstream API activity.
from logs-aws_bedrock.invocation-* metadata _id, _version, _index

| eval Esql.lowercase_prompt = TO_LOWER(gen_ai.prompt)

| where
    Esql.lowercase_prompt like "*/bin/sh*" or
    Esql.lowercase_prompt like "*/bin/bash*" or
    Esql.lowercase_prompt like "*sh -c*" or
    Esql.lowercase_prompt like "*cmd.exe*" or
    Esql.lowercase_prompt like "*powershell*" or
    Esql.lowercase_prompt like "*exec(*" or
    Esql.lowercase_prompt like "*os.system*" or
    Esql.lowercase_prompt like "*subprocess*" or
    Esql.lowercase_prompt like "*python -c*" or
    Esql.lowercase_prompt like "*python3 -c*" or
    Esql.lowercase_prompt like "*curl *" or
    Esql.lowercase_prompt like "*wget *" or
    Esql.lowercase_prompt like "*/dev/tcp/*" or
    Esql.lowercase_prompt like "*nc -e*" or
    Esql.lowercase_prompt like "*ncat *" or
    Esql.lowercase_prompt like "*socat *" or
    Esql.lowercase_prompt like "*openssl s_client*" or
    Esql.lowercase_prompt like "*perl -e*" or
    Esql.lowercase_prompt like "*ruby -e*" or
    Esql.lowercase_prompt like "*php -r*" or
    Esql.lowercase_prompt like "*node -e*" or
    Esql.lowercase_prompt like "*base64 -d*" or
    Esql.lowercase_prompt like "*bash -i*"

| keep _id, _version, _index, @timestamp, user.id, cloud.account.id, gen_ai.request.model.id, gen_ai.prompt, gen_ai.completion

Framework: MITRE ATT&CK