« AWS SageMaker Execution Role Passed by Unusual Principal Azure AKS CoreDNS or Kube-DNS Configuration Modified »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.29

AWS Bedrock High Risk Filesystem or Execution Tool Invocation

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

AWS Bedrock High Risk Filesystem or Execution Tool Invocation

edit

Detects when a Bedrock model is prompted to invoke high-risk tools associated with shell execution, filesystem operations, or process spawning. Adversaries may use compromised AI agent pipelines or manipulated prompts to instruct the model to execute arbitrary system commands, read or write sensitive files, or spawn subprocesses — extending the blast radius of a credential compromise or prompt injection attack.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 10m

Searches indices from: now-60m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Domain: LLM
  • Data Source: AWS Bedrock
  • Use Case: Threat Detection
  • Tactic: Execution
  • Resources: Investigation Guide

Version: 2

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating AWS Bedrock High Risk Filesystem or Execution Tool Invocation

This rule detects Bedrock model invocations where the prompt contains patterns associated with shell execution, filesystem access, or process spawning. These patterns may indicate a prompt injection attack, a compromised AI agent pipeline, or an insider attempting to use a Bedrock-backed application to execute unauthorized system operations.

Possible investigation steps

  • Review gen_ai.prompt to identify the specific tool invocation pattern that triggered the rule and determine whether it represents a legitimate tool call or a malicious instruction.
  • Identify the user (user.id) and determine whether they are expected to interact with tools that perform filesystem or shell operations.
  • Review the model ID (gen_ai.request.model.id) and the application context to understand whether shell or filesystem tools are part of the intended agent architecture.
  • Correlate with other Bedrock invocation events from the same user in the preceding hour to assess whether this is an isolated event or part of a pattern.
  • If the application uses Bedrock Agents, review the agent’s configured action groups and Lambda functions to determine whether the tool invocation could have resulted in actual execution.
  • Check for downstream evidence of execution: CloudTrail Lambda invocation events, SSM RunCommand, or EC2 activity correlated with the same time window.

False positive analysis

  • AI coding assistants and developer tools built on Bedrock may legitimately reference shell commands or file operations in their prompt templates.
  • Security tooling that uses Bedrock to analyze shell scripts or code may produce prompts containing these patterns.

Response and remediation

  • If a prompt injection is confirmed, identify the injection source and remediate the input validation gap in the application layer.
  • Review and restrict the tools available to the Bedrock Agent to the minimum required for its function.
  • Apply Bedrock Guardrails to block or flag prompts containing high-risk tool invocation patterns.
  • If credentials were compromised, rotate them immediately and audit all Bedrock and downstream API activity.

Setup

edit

The AWS Bedrock integration must be enabled with model invocation logging configured to capture prompt and completion content. Ensure logs-aws_bedrock.invocation-* is ingested into Elasticsearch.

Rule query

edit
from logs-aws_bedrock.invocation-* metadata _id, _version, _index

| eval Esql.lowercase_prompt = TO_LOWER(gen_ai.prompt)

| where
    Esql.lowercase_prompt like "*/bin/sh*" or
    Esql.lowercase_prompt like "*/bin/bash*" or
    Esql.lowercase_prompt like "*sh -c*" or
    Esql.lowercase_prompt like "*cmd.exe*" or
    Esql.lowercase_prompt like "*powershell*" or
    Esql.lowercase_prompt like "*exec(*" or
    Esql.lowercase_prompt like "*os.system*" or
    Esql.lowercase_prompt like "*subprocess*" or
    Esql.lowercase_prompt like "*python -c*" or
    Esql.lowercase_prompt like "*python3 -c*" or
    Esql.lowercase_prompt like "*curl *" or
    Esql.lowercase_prompt like "*wget *" or
    Esql.lowercase_prompt like "*/dev/tcp/*" or
    Esql.lowercase_prompt like "*nc -e*" or
    Esql.lowercase_prompt like "*ncat *" or
    Esql.lowercase_prompt like "*socat *" or
    Esql.lowercase_prompt like "*openssl s_client*" or
    Esql.lowercase_prompt like "*perl -e*" or
    Esql.lowercase_prompt like "*ruby -e*" or
    Esql.lowercase_prompt like "*php -r*" or
    Esql.lowercase_prompt like "*node -e*" or
    Esql.lowercase_prompt like "*base64 -d*" or
    Esql.lowercase_prompt like "*bash -i*"

| keep _id, _version, _index, @timestamp, user.id, cloud.account.id, gen_ai.request.model.id, gen_ai.prompt, gen_ai.completion

Framework: MITRE ATT&CKTM

« AWS SageMaker Execution Role Passed by Unusual Principal Azure AKS CoreDNS or Kube-DNS Configuration Modified »