AWS Lambda code modified
The code or configuration of a Lambda function was replaced.
What it detects
The code or configuration of a Lambda function was replaced.
A Lambda runs with its execution role's permissions and can be triggered by API Gateway, an S3 event or a schedule, so overwriting the code of an existing function converts something the account already trusts into attacker-controlled execution — no new resource to notice, and the function's own IAM role supplies the privileges.
MITRE ATT&CK mapping
False positives and triage
Deploying Lambda code is exactly what CI/CD does, so in any account with a deployment pipeline this is high-volume routine activity and must be baselined against the deploying role. The signal is an update from a human IAM user or an unfamiliar IP rather than the pipeline principal, an update outside deployment hours, or a configuration change that widens the function's environment or timeout without a code change.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/cloud/aws_lambda_code_modified.yaml, licensed under the Apache License 2.0.
id: cloud.aws.lambda_code_modified
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [application]
mitre_techniques: [T1204, T1648]
description: |
The code or configuration of a Lambda function was replaced.
A Lambda runs with its execution role's permissions and can be triggered by API
Gateway, an S3 event or a schedule, so overwriting the code of an existing
function converts something the account already trusts into attacker-controlled
execution — no new resource to notice, and the function's own IAM role supplies
the privileges.
match:
provider: AWS
event_action_contains_any:
- UpdateFunctionCode
- UpdateFunctionConfiguration
- PublishLayerVersion
- AddPermission20150331
correlation_keys: [user_name]
false_positive_guidance: |
Deploying Lambda code is exactly what CI/CD does, so in any account with a
deployment pipeline this is high-volume routine activity and must be baselined
against the deploying role. The signal is an update from a human IAM user or an
unfamiliar IP rather than the pipeline principal, an update outside deployment
hours, or a configuration change that widens the function's environment or
timeout without a code change.
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.