LoFP / developers, operators, and ci/cd or automation identities legitimately invoke functions directly for testing, operations, and deployments. new automation roles or first-time operators will generate this alert. verify the principal in `aws.cloudtrail.user_identity.arn`, the function, and the source before treating it as malicious, and exclude known operational identities after validation.

Techniques

• T1648

Sample rules

AWS Lambda Function Invoked by an Unusual Principal

• source: elastic
• technicques:
  • T1648

Description

Identifies the first time within the prior 14 days that a principal directly invokes an AWS Lambda function in an account, excluding invocations made on behalf of AWS services (normal event-source triggers). Adversaries who compromise credentials or move laterally may directly invoke functions to execute code, retrieve data returned by a function, or abuse an over-permissioned execution role. Direct, ad hoc invocation by a principal that does not normally call Lambda deviates from the usual event-driven invocation pattern and is worth reviewing. This rule relies on AWS Lambda data event logging, which is not enabled by default.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.action: Invoke*
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.invoked_by: *
    and aws.cloudtrail.user_identity.arn: *