Analytics BIOC Informational

Unusual AWS Bedrock model access request

A cloud identity requested access to an AWS Bedrock model. MITRE ATLAS Technique: AML.T0012 - Valid Accounts.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004)
Detector tags: Cloud AI Infrastructure Analytics
Attacker's goals:

Gain access to cloud AI/ML resources and services.

Investigative actions:

Examine which AWS Bedrock models were affected. Investigate any unusual activity originating from the suspected identity.

Test period:
N/A (single event)
Deduplication:
5 Days