New attack technique: Invoke Bedrock Model

[Brucedh]

What does this PR do?

New attack technique

Motivation

In the last few months, attackers started abusing Amazon Bedrock and running unauthorized inferences. This attack can result in a huge financial impact for the victims.

Documented attacks:

• https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/
• https://sysdig.com/blog/growing-dangers-of-llmjacking/
• https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts
• https://reinforce.awsevents.com/content/dam/reinforce/2024/slides/TDR432_New-tactics-and-techniques-for-proactive-threat-detection.pdf
• https://permiso.io/blog/exploiting-hosted-models

Checklist

• The attack technique emulates a single attack step, not a full attack chain
• We have factual evidence & references that the attack technique was used by real malware, pentesters, or attackers
• The attack technique makes no assumption about the state of the environment prior to warming it up