LoFP LoFP / T1648

T1648

TitleTags
application teams and infrastructure-as-code pipelines routinely create event source mappings to wire data pipelines, queue consumers, and stream processors to lambda functions. verify whether the principal in `aws.cloudtrail.user_identity.arn`, the function, and the event source are expected for the workload. known deployment roles and automation can be excluded after validation.
developers, operators, and ci/cd or automation identities legitimately invoke functions directly for testing, operations, and deployments. new automation roles or first-time operators will generate this alert. verify the principal in `aws.cloudtrail.user_identity.arn`, the function, and the source before treating it as malicious, and exclude known operational identities after validation.
lambda function owners or deployment pipelines may legitimately add or update layers as part of normal development and maintenance workflows. confirm that the layer addition aligns with approved changes, expected ci/cd behavior, or routine dependency updates. known automation roles or build systems can be excluded if they consistently perform authorized modifications.
legitimate changes to lambda functions can trigger this signal. ensure that the changes are authorized and align with your organization's policies.
multi-account architectures and partner integrations legitimately invoke functions across account boundaries. verify the caller account, the principal in `aws.cloudtrail.user_identity.arn`, and the function against approved cross-account access, and exclude known trusted accounts or identities after validation.
operators and automation may legitimately invoke functions from new networks (new offices, vpns, home ips, or new egress infrastructure). verify the principal in `aws.cloudtrail.user_identity.arn`, the source network, and the function, and exclude known operator networks or identities after validation.
organizations sometimes publish shared utility layers across their own accounts or to partners intentionally. verify the layer, the granted principal in `aws.cloudtrail.request_parameters`, and the principal in `aws.cloudtrail.user_identity.arn` against approved sharing practices. known shared layers and distribution accounts can be excluded after validation.
verify whether the user identity should be using the triggered api. if known behavior is causing false positives, it can be exempted from the rule. the \"history_window_start\" value can be modified to reflect the expected frequency of known activity within a particular environment.