title: AWS Bedrock Model Invocation
id: 2f0b7c3e-6a41-4c1e-9b8a-1d2e3f4a5b03
status: experimental
description: Bedrock invocation events. Railway links the campaign to targeting AI inference provider keys; alert on principals/regions with no prior Bedrock use (threshold/baseline in SIEM).
references:
    - https://blog.railway.com/p/security-disclosure-wednesday-october-21st
author: Defensive detection pack
date: 2026-10-22
tags:
    - attack.impact
    - attack.t1496
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: bedrock.amazonaws.com
        eventName:
            - InvokeModel
            - InvokeModelWithResponseStream
            - Converse
            - ConverseStream
    condition: selection
falsepositives:
    - Legitimate AI workloads (requires baselining)
level: low