Elastic low stable kql

AWS Lambda Function Created or Updated

Identifies when an AWS Lambda function is created or updated. AWS Lambda lets you run code without provisioning or managing servers. Adversaries can create or update Lambda functions to execute malicious code, exfiltrate data, or escalate privileges. This is a [building block rule](https://www.elastic.co/guide/en/security/current/building-block-rule.html) that does not generate alerts, but signals when a Lambda function is created or updated that matches the rule's conditions. To generate alerts, create a rule that uses this signal as a building block.

View Source

Detection Logic

event.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.outcome: "success"
    and event.action: (CreateFunction* or UpdateFunctionCode*)
    and not user_agent.original: (*Terraform* or *Pulumi*)

False Positives

⚠ Legitimate changes to Lambda functions can trigger this signal. Ensure that the changes are authorized and align with your organization's policies.

Field Validations

Loading…

Comments (0)

Loading comments...