AWS Bedrock Model Invocation Abnormal Token Usage

Description

Monitors for potential misuse or abuse of AWS Bedrock AI models by detecting abnormal token usage patterns and alerts when the total token usage exceeds the appropriate threshold for each different type of model.

Query · python

def rule(event):
    # Only process InvokeModel and Converse operations
    if event.get("operation") not in ["InvokeModel", "Converse"]:
        return False

    # retrieve the necessary values from the logs
    token_usage = event.deep_get("output", "outputBodyJson", "usage", "totalTokens", default=0)
    model_id = event.get("modelId", default="")
    # Get the appropriate threshold for each model
    if "haiku" in model_id:
        threshold = 3000
    elif "sonnet" in model_id:
        threshold = 4000
    elif "opus" in model_id:
        threshold = 5000
    else:
        threshold = 4000  # default threshold
    # Check for abnormal token usage
    if token_usage > threshold:
        return True
    # Flag unusual token patterns (high usage with no actual output)
    output_tokens = event.deep_get("output", "outputBodyJson", "usage", "outputTokens", default=0)
    if token_usage > 1000 and output_tokens == 0:
        return True
    return False


def title(event):
    model_id = event.get("modelId", default="unknown")
    operation_name = event.get("operation", default="unknown")
    account_id = event.get("accountId", default="unknown")
    token_usage = event.deep_get("output", "outputBodyJson", "usage", "totalTokens", default=0)
    title_parts = [
        f"Abnormal token usage detected: {token_usage} tokens",
        f"Model: {model_id}",
        f"Operation: {operation_name}",
        f"Account: {account_id}",
    ]
    return " | ".join(title_parts)

Analyst notes

Verify the alert details by checking token usage, model ID, and account information to confirm unusual activity, examine user access patterns to identify potential credential compromise, and look for evidence of prompt injection, unusual repetition, or attempts to bypass usage limits. Apply stricter usage quotas to the affected account, block suspicious IP addresses, and enhance the guardrails that are in place.

Raw source AWS Bedrock Model Invocation Abnormal Token Usage · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: aws_bedrockmodelinvocation_abnormaltokenusage.py
RuleID: "AWS.BedrockModelInvocation.AbnormalTokenUsage"
DisplayName: "AWS Bedrock Model Invocation Abnormal Token Usage"
Enabled: true
LogTypes:
    - AWS.BedrockModelInvocation
Tags:
    - AWS
    - Bedrock
    - Resource Hijacking
Status: Experimental
Severity: Info
Reports:
    MITRE ATT&CK:
        - TA0040:T1496.004
Description: Monitors for potential misuse or abuse of AWS Bedrock AI models by detecting abnormal token usage patterns and alerts when the total token usage exceeds the appropriate threshold for each different type of model.
Runbook: Verify the alert details by checking token usage, model ID, and account information to confirm unusual activity, examine user access patterns to identify potential credential compromise, and look for evidence of prompt injection, unusual repetition, or attempts to bypass usage limits. Apply stricter usage quotas to the affected account, block suspicious IP addresses, and enhance the guardrails that are in place.
DedupPeriodMinutes: 60
Threshold: 1
Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.impact.bedrock-invoke-model/
SummaryAttributes:
  - p_any_aws_account_ids
  - p_any_aws_arns
InlineFilters:
    - All: []
Tests:
    - Name: Converse Operation Unusual Token Patterns
      ExpectedResult: true
      Log:
        accountId: "111111111111"
        identity:
            arn: arn:aws:sts::111111111111:assumed-role/role_details/suspicious.user
        input:
            inputBodyJson:
                messages:
                    - content:
                        - text: I have a very suspicious question.
                      role: user
            inputContentType: application/json
            inputTokenCount: 0
        modelId: anthropic.claude-3-haiku-20240307-v1:0
        operation: Converse
        output:
            outputBodyJson:
                metrics:
                    latencyMs: 249
                output:
                    message:
                        content:
                            - text: You shouldn't ask this question
                        role: assistant
                usage:
                    inputTokens: 0
                    outputTokens: 0
                    totalTokens: 2000
            outputContentType: application/json
            outputTokenCount: 0
        region: us-west-2
        requestId: bb98d9a8-bd9a-47ca-976b-f165ef1f8b67
        schemaType: ModelInvocationLog
        schemaVersion: "1.0"
        timestamp: "2025-05-15 14:17:22.000000000"
    - Name: Converse Operation with Abnormal Token Usage
      ExpectedResult: true
      Log:
        accountId: "111111111111"
        identity:
            arn: arn:aws:sts::111111111111:assumed-role/role_details/suspicious.user
        input:
            inputBodyJson:
                messages:
                    - content:
                        - text: I have a very suspicious question.
                      role: user
            inputContentType: application/json
            inputTokenCount: 0
        modelId: anthropic.claude-3-haiku-20240307-v1:0
        operation: Converse
        output:
            outputBodyJson:
                metrics:
                    latencyMs: 249
                output:
                    message:
                        content:
                            - text: You shouldn't ask this question
                        role: assistant
                usage:
                    inputTokens: 0
                    outputTokens: 0
                    totalTokens: 5000
            outputContentType: application/json
            outputTokenCount: 0
        region: us-west-2
        requestId: bb98d9a8-bd9a-47ca-976b-f165ef1f8b67
        schemaType: ModelInvocationLog
        schemaVersion: "1.0"
        timestamp: "2025-05-15 14:17:22.000000000"
    - Name: Perform Another Operation
      ExpectedResult: false
      Log:
        accountId: "111111111111"
        identity:
            arn: arn:aws:sts::111111111111:assumed-role/role_details/regular.user
        input:
            inputBodyJson:
                messages:
                    - content:
                        - text: I have a rather normal question.
                      role: user
            inputContentType: application/json
            inputTokenCount: 0
        modelId: anthropic.claude-3-haiku-20240307-v1:0
        operation: ListModels
        output:
            outputBodyJson:
                metrics:
                    latencyMs: 249
                output:
                    message:
                        content:
                            - text: I can respond to this question
                        role: assistant
                usage:
                    inputTokens: 0
                    outputTokens: 0
                    totalTokens: 0
            outputContentType: application/json
            outputTokenCount: 0
        region: us-west-2
        requestId: bb98d9a8-bd9a-47ca-976b-f165ef1f8b67
        schemaType: ModelInvocationLog
        schemaVersion: "1.0"
        timestamp: "2025-05-15 14:17:22.000000000"
    - Name: Regular Converse Operation with Normal Token Usage
      ExpectedResult: false
      Log:
        accountId: "111111111111"
        identity:
            arn: arn:aws:sts::111111111111:assumed-role/role_details/regular.user
        input:
            inputBodyJson:
                messages:
                    - content:
                        - text: I have a rather normal question.
                      role: user
            inputContentType: application/json
            inputTokenCount: 0
        modelId: anthropic.claude-3-haiku-20240307-v1:0
        operation: Converse
        output:
            outputBodyJson:
                metrics:
                    latencyMs: 249
                output:
                    message:
                        content:
                            - text: I can respond to this question
                        role: assistant
                usage:
                    inputTokens: 0
                    outputTokens: 0
                    totalTokens: 0
            outputContentType: application/json
            outputTokenCount: 0
        region: us-west-2
        requestId: bb98d9a8-bd9a-47ca-976b-f165ef1f8b67
        schemaType: ModelInvocationLog
        schemaVersion: "1.0"
        timestamp: "2025-05-15 14:17:22.000000000"

# ------ paired body: aws_bedrockmodelinvocation_abnormaltokenusage.py ------

def rule(event):
    # Only process InvokeModel and Converse operations
    if event.get("operation") not in ["InvokeModel", "Converse"]:
        return False

    # retrieve the necessary values from the logs
    token_usage = event.deep_get("output", "outputBodyJson", "usage", "totalTokens", default=0)
    model_id = event.get("modelId", default="")
    # Get the appropriate threshold for each model
    if "haiku" in model_id:
        threshold = 3000
    elif "sonnet" in model_id:
        threshold = 4000
    elif "opus" in model_id:
        threshold = 5000
    else:
        threshold = 4000  # default threshold
    # Check for abnormal token usage
    if token_usage > threshold:
        return True
    # Flag unusual token patterns (high usage with no actual output)
    output_tokens = event.deep_get("output", "outputBodyJson", "usage", "outputTokens", default=0)
    if token_usage > 1000 and output_tokens == 0:
        return True
    return False


def title(event):
    model_id = event.get("modelId", default="unknown")
    operation_name = event.get("operation", default="unknown")
    account_id = event.get("accountId", default="unknown")
    token_usage = event.deep_get("output", "outputBodyJson", "usage", "totalTokens", default=0)
    title_parts = [
        f"Abnormal token usage detected: {token_usage} tokens",
        f"Model: {model_id}",
        f"Operation: {operation_name}",
        f"Account: {account_id}",
    ]
    return " | ".join(title_parts)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.