Cross-source coverage
T1648 / ATT&CK
Serverless Execution
11 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. Resource Hijacking). Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the IAM:PassRole permission in AWS or the iam.serviceAccounts.actAs permission in Google Cloud to add Additional Cloud Roles to a serverless cloud function, which may then be able to perform actions the original user cannot.
Serverless functions can also be invoked in response to cloud events (i.e. Event Triggered Execution), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds Additional Cloud Credentials to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created. This is also possible in many cloud-based office application suites. For example, in Microsoft 365 environments, an adversary may create a Power Automate workflow that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint. In Google Workspace environments, they may instead create an Apps Script that exfiltrates a user's data when they open a file.
- Tactics
- Execution
- Platforms
- SaaS · IaaS · Office Suite
- Telemetry
-
AWS:CloudTrailm365:unifiedm365:exchangesaas:appsscriptsaas:googledrive
How MITRE says to detect it DET0374
Detection Strategy for Serverless Execution (T1648)
IaaS Analytic 1053
Correlate creation or modification of serverless functions (e.g., AWS Lambda, GCP Cloud Functions, Azure Functions) with anomalous IAM role assignments or permissions escalation events. Detect subsequent executions of newly created functions that perform unexpected actions such as spawning outbound network connections, accessing sensitive resources, or creating additional credentials.
AWS:CloudTrailCreateFunction / UpdateFunctionConfiguration: Function creation, role assignment, or configuration change eventsAWS:CloudTrailInvokeFunction: Unexpected or repeated invocation of functions not tied to known workflows
Office Suite Analytic 1054
Monitor for creation of new Power Automate flows or equivalent automation scripts that trigger on user or file events. Detect anomalous actions performed by these automations, such as email forwarding, anonymous link creation, or unexpected API calls to external endpoints.
m365:unifiedAddFlow / UpdateFlow: New automation or workflow creation eventsm365:exchangeNew-InboxRule: Automation that triggers abnormal forwarding or external link generation
SaaS Analytic 1055
Track creation or update of SaaS automation scripts (e.g., Google Workspace Apps Script). Detect when these scripts are bound to user events such as file opens or account modifications, and correlate with subsequent abnormal API calls that exfiltrate or modify user data.
saas:appsscriptCreate / Update: Deployment of scripts with event-driven triggerssaas:googledriveFileOpen / FileAccess: Event-driven script triggering on user file actions
elastic/detection-rules
10 rules| Detection | Severity | Format |
|---|---|---|
| AWS Lambda Function Invoked by an Unusual Principal | Medium | Elastic TOML |
| AWS Lambda Function Invoked Cross-Account | Medium | Elastic TOML |
| AWS Lambda Function Invoked from an Unusual Source ASN | Medium | Elastic TOML |
| AWS Lambda Layer Shared Externally | Medium | Elastic TOML |
| First Time AWS CloudFormation Stack Creation | Medium | Elastic TOML |
| AWS Lambda Event Source Mapping Creation | Low | Elastic TOML |
| AWS Lambda Layer Added to Existing Function | Low | Elastic TOML |
| Azure Automation Runbook Created or Modified | Low | Elastic TOML |
| GitHub App Deleted | Low | Elastic TOML |
| High Number of Cloned GitHub Repos From PAT | Low | Elastic TOML |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| aws_lambda_update_function_code | Low | YARA-L |