LoFP / lambda functions are routinely deleted during application decommissioning, environment teardown, and infrastructure-as-code apply/destroy cycles. verify whether the principal in `aws.cloudtrail.user_identity.arn` and the deleted function are expected for the workload, and whether the change aligns with an approved maintenance or deployment window. known deployment roles and automation can be excluded after validation.

Techniques

• T1485
• T1489

Sample rules

AWS Lambda Function Deletion by Unusual User

• source: elastic
• technicques:
  • T1485
  • T1489

Description

Identifies when an unusual user deletes an AWS Lambda function. Deleting a function removes its code, configuration, versions, and aliases. Adversaries may delete functions to disrupt business operations and automated workflows, to destroy attacker-deployed backdoors and remove evidence after achieving their objective, or to inhibit incident response. Because function deletion is destructive and often irreversible without redeployment, deletions performed by unexpected principals or outside change windows should be reviewed. This is a New Terms rule that uses “cloud.account.id”, “user.name”, and “aws.cloudtrail.flattened.request_parameters.functionName” to alert on the first time a given identity in an account successfully deletes a specific Lambda function within the history window.

Detection logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.action: (DeleteFunction or DeleteFunction20*)
    and event.outcome: "success"
    and user.name: (* and not AWSServiceRoleForLambdaReplicator)
    and aws.cloudtrail.flattened.request_parameters.functionName: *
    and not user_agent.original: (*Pulumi* or *Terraform*)