Detects a single AWS principal invoking Amazon Bedrock models from three or more countries and from three or more distinct source IPs within the last 4 hours (lookback window). The rule analyzes Bedrock-related CloudTrail management events (InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream) and groups activity by the issuing role or user identity to correlate across re-assumes, capturing activity that may indicate credential sharing, resale, or proxy usage for LLMjacking. It requires GeoIP enrichment (source.geo.country_name and source.ip) and surfaces aggregated fields such as country_count, source_ip_count, user_agent_count, and various identity/IP related values. A match is emitted when country_count >= 3 and source_ip_count >= 3, enabling investigators to inspect potential credential theft or abuse across multiple operators and locations. The rule maps to ATT&CK techniques related to Credential Access and Cloud Valid Accounts, and to ATLAS AML techniques covering Valid Accounts and Use of Alternate Authentication Material. It provides triage guidance, remediation steps, and cost controls to contain abuse. The setup note specifies enabling AWS CloudTrail management events with GeoIP enrichment since Bedrock operations are logged as management events by default. The alert is designed to trigger on high-signal, low-noise patterns that indicate anomalous multi-country/跨-IP activity from a single identity and is complemented by investigation fields to aid follow-up actions.