title: AWS Bedrock Model Invocation Logging Disabled
id: 74a6d44b-05b2-4c06-99dc-3269cefc15e6
status: experimental
description: Detects deletion of an AWS Bedrock model invocation logging configuration. Invocation logging captures full model request/response content and metadata to CloudWatch/S3 and is the primary forensic source for AI-abuse investigations; deleting it is AI-specific anti-forensics, analogous to disabling audit policy. Splunk Security Content tracks this detection ("AWS Bedrock Security" analytic story, May 2026); this is the Sigma-native version for pipelines without Splunk.
references:
    - https://research.splunk.com/cloud/9c5e3d62-f743-11ee-9f6e-acde48001124/
    - https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
author: Agentic Threat Lab
date: 2026-10-22
atlas:
    - AML.T0081
logsource:
    category: cloud
    product: aws
    service: cloudtrail
detection:
    selection:
        EventSource: bedrock.amazonaws.com
        EventName: DeleteModelInvocationLoggingConfiguration
    condition: selection
falsepositives:
    - Genuinely decommissioned Bedrock workloads by authorized administrators (rare; verify change ticket)
level: high