KMON_NOC Credential Validation Platform Targeting AWS Keys for Amazon Bedrock LLM Access — OTX Pulse Analysis & Detection Pack

---
title: Suspicious AWS Credential Validation - GetCallerIdentity from External IP
id: 7f3a2c1e-9b4d-4e5a-a1c2-8d6f0e1b2c3d
status: experimental
description: Detects STS GetCallerIdentity calls originating from known credential-validation infrastructure or non-corporate IP space, consistent with KMON_NOC-style stolen key validation observed in OTX pulse data.
author: Security Arsenal Threat Intelligence
date: 2026/10/09
references:
    - https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event:
        eventSource: sts.amazonaws.com
        eventName: GetCallerIdentity
    selection_badip:
        sourceIPAddress:
            - 112.78.151.90
            - 78.109.78.211
            - 83.194.172.248
            - 103.160.185.100
            - 109.146.93.39
            - 115.138.247.83
    condition: selection_event and selection_badip
falsepositives:
    - Legitimate developer tooling from VPN egress if IPs overlap (unlikely for listed infrastructure)
level: high
tags:
    - attack.discovery
    - attack.t1087
    - attack.t1078
---
title: Amazon Bedrock Foundation Model Enumeration - Potential LLMjacking Recon
id: 2b8c4d5f-1a3e-4f6b-b2d3-9c7e1f0a3d4e
status: experimental
description: Detects Bedrock ListFoundationModels or GetFoundationModel calls from IAM identities that have no prior Bedrock usage baseline, indicating capability probing of stolen AWS keys for LLM access.
author: Security Arsenal Threat Intelligence
date: 2026/10/09
references:
    - https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: bedrock.amazonaws.com
        eventName:
            - ListFoundationModels
            - GetFoundationModel
            - ListModelCustomizationJobs
    filter_known_bedrock_users:
        userIdentity.type:
            - AssumedRole
        userIdentity.principalId|contains:
            - bedrock-automation
            - approved-ml-pipeline
    condition: selection and not filter_known_bedrock_users
falsepositives:
    - Developers exploring Bedrock for the first time in sandbox accounts
    - New ML pipeline onboarding
level: medium
tags:
    - attack.discovery
    - attack.t1526
    - attack.t1078
---
title: Bedrock InvokeModel from Identity Without Prior Bedrock History - Token Jacking
id: 9e1d6a7b-3c5f-4a8b-c4e5-0d2f1a3b4c5d
status: experimental
description: Detects Bedrock InvokeModel/Converse API calls immediately following GetCallerIdentity from the same identity within a short window — the signature KMON_NOC validation-to-abuse sequence.
author: Security Arsenal Threat Intelligence
date: 2026/10/09
references:
    - https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: bedrock.amazonaws.com
        eventName:
            - InvokeModel
            - InvokeModelWithResponseStream
            - Converse
            - ConverseStream
    condition: selection
timeframe: 15m
correlation:
    type: temporal
    rules:
        - Suspicious AWS Credential Validation - GetCallerIdentity from External IP
    group-by:
        - userIdentity.accessKeyId
falsepositives:
    - CI/CD jobs that validate identity then invoke models (baseline these principals)
level: critical
tags:
    - attack.impact
    - attack.t1496
    - attack.t1078

// Hunt: Stolen AWS key validation for Bedrock access (KMON_NOC pattern)
// Part 1: CloudTrail validation + probing sequence from known bad IPs or unusual sources
let BadIPs = dynamic(["112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83"]);
let Validation =
    AWSCloudTrail
    | where TimeGenerated > ago(30d)
    | where EventSource == "sts.amazonaws.com" and EventName == "GetCallerIdentity"
    | project KeyId = UserIdentityAccessKeyId, Identity = UserIdentityPrincipalId, ValidationTime = TimeGenerated, SourceIP = SourceIpAddress, Account = RecipientAccountId;
let BedrockProbe =
    AWSCloudTrail
    | where TimeGenerated > ago(30d)
    | where EventSource == "bedrock.amazonaws.com"
    | where EventName in ("ListFoundationModels","GetFoundationModel","InvokeModel","InvokeModelWithResponseStream","Converse","ConverseStream")
    | project KeyId = UserIdentityAccessKeyId, ProbeTime = TimeGenerated, ProbeEvent = EventName, ProbeIP = SourceIpAddress, Region = AwsRegion;
Validation
| join kind=inner BedrockProbe on KeyId
| where ProbeTime between (ValidationTime .. ValidationTime + 1h)
| extend KnownBadIP = SourceIP in (BadIPs) or ProbeIP in (BadIPs)
| summarize FirstValidation = min(ValidationTime), ProbeEvents = make_set(ProbeEvent), Regions = make_set(Region), SourceIPs = make_set(SourceIP), ProbeIPs = make_set(ProbeIP), MaxKnownBad = max(KnownBadIP) by KeyId, Identity, Account
| order by MaxKnownBad desc, FirstValidation desc;
// Part 2: Endpoint hunt — processes accessing AWS credential files followed by cloud SDK network activity
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any (".aws\\credentials", ".aws/credentials", "aws_access_key_id", "aws_secret_access_key")
| where InitiatingProcessFileName !in~ ("aws.exe", "python.exe", "code.exe", "terraform.exe")
| project DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, TimeGenerated
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any ("bedrock", "sts.amazonaws.com") or RemoteIP in ("112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83")
    | project DeviceName, RemoteUrl, RemoteIP, NetTime = TimeGenerated
) on DeviceName
| order by TimeGenerated desc;

# Security Arsenal - KMON_NOC / AWS Bedrock Token-Jacking Hunt
# Searches for exposed AWS keys, suspicious AWS CLI usage, and bad-IP connections
# Run elevated. Outputs to C:\HuntResults\aws_tokenjack_hunt_<timestamp>.txt

$ErrorActionPreference = 'SilentlyContinue'
$BadIPs = @("112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83")
$BadHashes = @(
    "923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608",
    "c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc"
)
$OutDir = "C:\HuntResults"
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
$Out = Join-Path $OutDir ("aws_tokenjack_hunt_" + (Get-Date -Format 'yyyyMMdd_HHmmss') + ".txt")

function Log($msg) { $line = "[{0}] {1}" -f (Get-Date -Format 'u'), $msg; Write-Host $line; Add-Content -Path $Out -Value $line }

Log "=== AWS Token-Jacking Hunt Started ==="

# 1. Active / recent connections to validation infrastructure
Log "--- [1] Checking network connections to known validation IPs ---"
$conns = Get-NetTCPConnection | Where-Object { $BadIPs -contains $_.RemoteAddress }
if ($conns) {
    foreach ($c in $conns) {
        $proc = Get-Process -Id $c.OwningProcess
        Log ("ALERT: Connection to {0}:{1} from PID {2} ({3}) State={4}" -f $c.RemoteAddress, $c.RemotePort, $c.OwningProcess, $proc.ProcessName, $c.State)
    }
} else { Log "OK: No active connections to known validation IPs." }

# 2. Exposed AWS credential files on disk
Log "--- [2] Locating AWS credential files and checking permissions ---"
$credPaths = @("$env:USERPROFILE\.aws\credentials", "C:\Users\*\.aws\credentials", "$env:ProgramData\Amazon\AWSCLI")
foreach ($p in $credPaths) {
    Get-Item $p | ForEach-Object {
        Log ("FOUND credential file: {0} (LastWrite: {1})" -f $_.FullName, $_.LastWriteTime)
        $content = Get-Content $_.FullName -Raw
        if ($content -match "aws_secret_access_key\s*=\s*\S+") { Log "WARNING: Live secret key material present in $($_.FullName) - rotate if unneeded." }
    }
}

# 3. Scan common dev locations for hardcoded AWS keys (AKIA pattern)
Log "--- [3] Scanning repos/scripts for hardcoded AKIA-style access keys ---"
$searchRoots = @("$env:USERPROFILE\source", "$env:USERPROFILE\repos", "$env:USERPROFILE\Documents")
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        Get-ChildItem $root -Recurse -Include *.env,*.cfg,*.ini,*.json,*.yaml,*.yml,*.ps1,*.py -ErrorAction SilentlyContinue |
            Select-String -Pattern "AKIA[0-9A-Z]{16}" -List |
            ForEach-Object { Log ("ALERT: Hardcoded AWS key pattern in {0} line {1}" -f $_.Path, $_.LineNumber) }
    }
}

# 4. Suspicious AWS CLI / SDK process artifacts in Prefetch & recent PowerShell history
Log "--- [4] Reviewing PowerShell history for credential-access or Bedrock commands ---"
$psHistory = "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"
if (Test-Path $psHistory) {
    Select-String -Path $psHistory -Pattern "Get-CallerIdentity|GetCallerIdentity|ListFoundationModels|InvokeModel|bedrock|aws sts" |
        ForEach-Object { Log ("ALERT: Suspicious PS history entry: {0}" -f $_.Line.Trim()) }
}

# 5. Hash sweep for associated tooling in common staging dirs
Log "--- [5] Hash-sweeping staging directories for known tool artifacts ---"
$staging = @("$env:TEMP", "C:\Users\Public", "$env:ProgramData")
foreach ($dir in $staging) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($BadHashes -contains $h) { Log ("CRITICAL: Known malicious artifact hash match: {0} ({1})" -f $_.FullName, $h) }
    }
}

# 6. Check for scheduled tasks invoking aws.exe from unusual contexts
Log "--- [6] Auditing scheduled tasks referencing AWS tooling ---"
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match "aws\.exe|bedrock|GetCallerIdentity") {
        Log ("REVIEW: Task '{0}' invokes AWS tooling -> {1}" -f $_.TaskName, ($actions -replace "\s+"," "))
    }
}

Log "=== Hunt Complete. Results: $Out ==="