Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWS Bedrock Automated Reasoning Safety Policy Tampering

Detects deletion or modification of AWS Bedrock Automated Reasoning policies via the DeleteAutomatedReasoningPolicy, UpdateAutomatedReasoningPolicy, or UpdateAutomatedReasoningPolicyAnnotations CloudTrail actions. Automated Reasoning policies are a Bedrock safety and validation control that constrains model outputs against formal rules. An adversary who deletes a policy or alters the policy definition or its annotations weakens an enforced output-validation defense, potentially allowing unsafe or non-compliant model responses to pass unchecked. Benign build, test-workflow, and test-case CRUD operations are intentionally excluded as they have no coherent abuse path.

ATT&CK coverage

Outside the enterprise matrix

T1685Disable or Modify ToolsMapped as T1562 and T1562.001, withdrawn by ATT&CK.

Detection requirements

Log source category: event_index

What the source says

What fires this without an attack behind it

Policy administrators, ML platform engineers, or infrastructure-as-code pipelines may legitimately update or remove Automated Reasoning policies during model governance changes, policy tuning, or environment teardown. Verify that the user identity, source IP, and user agent correspond to an approved change and that a corresponding change request exists. Known automation roles can be exempted if they generate recurring noise.

References

https://docs.aws.amazon.com/bedrock/latest/userguide/automated-reasoning.html

Tagged by the source as

Data Source: Amazon BedrockData Source: Amazon Web ServicesData Source: AWSData Source: AWS CloudTrailDomain: CloudDomain: LLMResources: Investigation GuideTactic: Defense EvasionUse Case: Threat Detection

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.

AWS Bedrock Automated Reasoning Safety Policy Tampering