UpdateFunctionCode20150331v2

CSP: AWS

Tactics:

Persistence Execution

Techniques:

T1059T1546

Tags:

AWS Lambda

Event

Updates the code of an existing Lambda function with a new deployment package or container image URI.

Security Context

• Serverless function invocation can be abused to execute arbitrary code within the cloud environment without provisioning persistent infrastructure.

Log Source

CloudTrail

Sample Event

MITRE ATT&CK Mapping

Tactics: Persistence Execution

Techniques:

• T1059 — Command and Scripting Interpreter — Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms.
• T1546 — Event Triggered Execution — Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.