sigmamediumHunting

AWS Bedrock Guardrail Updated

Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses.

MITRE ATT&CK

T1685

Detection Query

selection:
  eventName: UpdateGuardrail
  eventSource: bedrock.amazonaws.com
condition: selection

Author

Marco Pedrinazzi (@pedrinazziM) (InTheCyber)

Created

2026-07-10

Data Sources

awscloudtrail

Platforms

aws

References

https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html

Tags

attack.defense-impairmentattack.t1685

Raw Content

title: AWS Bedrock Guardrail Updated
id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f
status: experimental
description: |
    Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
    model safety controls and allow unsafe or unauthorized model responses.
references:
    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-07-10
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'UpdateGuardrail'
        eventSource: 'bedrock.amazonaws.com'
    condition: selection
falsepositives:
    - Legitimate guardrail updates by authorized identities.
level: medium