Skip to content

Invoke

AWS

Invoke

service: AWS - Lambda
tactics:
techniques:

Event

Invokes a Lambda function synchronously or asynchronously, triggering its execution with an optional input payload.

Security Context

  • Serverless function invocation can be abused to execute arbitrary code within the cloud environment without provisioning persistent infrastructure.

Log Source

CloudTrail

Sample Event

Adversarial — execution. Draco invokes the prod phoenix-restore-handler Lambda function with a crafted payload that triggers the function’s restore-from-backup path against a snapshot ARN under the adversary’s control. Lambda runs with the function’s execution role (which has s3:PutObject to a customer-data bucket) — by overwriting destination data, Draco gets effective code execution under a privileged role he never directly possessed. T1648 (Cloud API) + T1059 (Command and Scripting Interpreter — via the function’s runtime).

{
"eventVersion": "1.09",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDADRAC0MALF0YBADGY",
"arn": "arn:aws:iam::555123456789:user/draco",
"accountId": "555123456789",
"accessKeyId": "AKIADRAC0MALF0YEXAMP5",
"userName": "draco",
"sessionContext": {
"attributes": {
"creationDate": "2026-04-15T21:42:08Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2026-04-15T22:09:48Z",
"eventSource": "lambda.amazonaws.com",
"eventName": "Invoke",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.66",
"userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
"requestParameters": {
"functionName": "arn:aws:lambda:us-east-1:555123456789:function:phoenix-restore-handler",
"invocationType": "RequestResponse",
"qualifier": "$LATEST"
},
"responseElements": null,
"requestID": "90000000-0000-4000-8000-000101001100",
"eventID": "90000000-0000-4000-8000-000101001101",
"readOnly": false,
"resources": [
{
"accountId": "555123456789",
"type": "AWS::Lambda::Function",
"ARN": "arn:aws:lambda:us-east-1:555123456789:function:phoenix-restore-handler"
}
],
"eventType": "AwsApiCall",
"managementEvent": false,
"recipientAccountId": "555123456789",
"eventCategory": "Data",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "lambda.us-east-1.amazonaws.com"
}
}

MITRE ATT&CK Mapping

Tactics: Execution

Techniques:
  • T1648 — Serverless Execution — Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
  • T1059 — Command and Scripting Interpreter — Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface a...