Invoke
AWS
Invoke
Event
Invokes a Lambda function synchronously or asynchronously, triggering its execution with an optional input payload.
Security Context
- Serverless function invocation can be abused to execute arbitrary code within the cloud environment without provisioning persistent infrastructure.
Log Source
CloudTrail
Sample Event
Adversarial — execution. Draco invokes the prod phoenix-restore-handler Lambda function with a crafted payload that triggers the function’s restore-from-backup path against a snapshot ARN under the adversary’s control. Lambda runs with the function’s execution role (which has s3:PutObject to a customer-data bucket) — by overwriting destination data, Draco gets effective code execution under a privileged role he never directly possessed. T1648 (Cloud API) + T1059 (Command and Scripting Interpreter — via the function’s runtime).
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDADRAC0MALF0YBADGY", "arn": "arn:aws:iam::555123456789:user/draco", "accountId": "555123456789", "accessKeyId": "AKIADRAC0MALF0YEXAMP5", "userName": "draco", "sessionContext": { "attributes": { "creationDate": "2026-04-15T21:42:08Z", "mfaAuthenticated": "false" } } }, "eventTime": "2026-04-15T22:09:48Z", "eventSource": "lambda.amazonaws.com", "eventName": "Invoke", "awsRegion": "us-east-1", "sourceIPAddress": "203.0.113.66", "userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6", "requestParameters": { "functionName": "arn:aws:lambda:us-east-1:555123456789:function:phoenix-restore-handler", "invocationType": "RequestResponse", "qualifier": "$LATEST" }, "responseElements": null, "requestID": "90000000-0000-4000-8000-000101001100", "eventID": "90000000-0000-4000-8000-000101001101", "readOnly": false, "resources": [ { "accountId": "555123456789", "type": "AWS::Lambda::Function", "ARN": "arn:aws:lambda:us-east-1:555123456789:function:phoenix-restore-handler" } ], "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "555123456789", "eventCategory": "Data", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "lambda.us-east-1.amazonaws.com" }}MITRE ATT&CK Mapping
Tactics: Execution
Techniques:
- T1648 — Serverless Execution — Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
- T1059 — Command and Scripting Interpreter — Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface a...