LoFP / legitimate high-throughput applications, batch jobs, load tests, and automation can invoke functions at high volume and will exceed any fixed threshold. validate the principal in `aws.cloudtrail.user_identity.arn` and the workload context, and tune the threshold to the environment.

Techniques

• T1496

Sample rules

AWS Lambda Function High-Frequency Invocation by a Single Principal

• source: elastic
• technicques:
  • T1496

Description

Identifies a single principal directly invoking AWS Lambda functions at a high volume within a one-hour window. Adversaries may drive excessive invocations to abuse functions for resource hijacking or cryptomining, to inflate costs in a denial-of-wallet attack, or to enumerate function behavior. This is a volumetric heuristic: the threshold is environment-dependent and high-throughput applications can exceed it, so tune it to the deployment. This rule relies on AWS Lambda data event logging, which is not enabled by default.

Detection logic

from logs-aws.cloudtrail-*

// Lambda invocation data events (data-plane; requires data event logging enabled)
| where
    event.provider == "lambda.amazonaws.com"
    and event.action like "Invoke*"
    and event.outcome == "success"
    and aws.cloudtrail.user_identity.arn IS NOT NULL

| stats
    Esql.invocation_count = count(*),
    Esql.source_ips = values(source.ip)
  by
    aws.cloudtrail.user_identity.arn

// Threshold is environment-dependent — tune to the deployment
| where Esql.invocation_count >= 1000

| keep
    aws.cloudtrail.user_identity.arn,
    Esql.invocation_count,
    Esql.source_ips

| sort Esql.invocation_count desc