Detectionlowtest

AWS New Lambda Layer Attached

Detects when a user attached a Lambda layer to an existing Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Austin SongerCreated Thu Sep 23Updated Mon Mar 1797fbabf8-8e1b-47a2-b7d5-a418d2b95e3dcloud

Log Source

AWScloudtrail

ProductAWS← raw: aws

Servicecloudtrail← raw: cloudtrail

Detection Logic

detection:
    selection:
        eventSource: lambda.amazonaws.com
        eventName|startswith: 'UpdateFunctionConfiguration'
        requestParameters.layers|contains: '*'
    condition: selection

False Positives

Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.

Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

References

MITRE ATT&CK

Tactics

TA0004 · Privilege Escalation

Rule Metadata

Rule ID

97fbabf8-8e1b-47a2-b7d5-a418d2b95e3d

Status