Analytics BIOC
Low
✕
AWS Bedrock model invocation logging deletion
A cloud identity deleted the model invocation logging.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Cloud Logs (T1562.008)
Detector tags: Cloud AI Infrastructure Analytics
Attacker's goals:
Avoid detection by limiting collected data from models.
Investigative actions:
Investigate any unusual activity originating from the suspected identity.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
2 variations:
- AWS Bedrock model invocation logging deletion by an identity with administrative activity Informational (parent: Low)
- AWS Bedrock model invocation logging was successfully deleted Low