You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#### AWS Lambda Layer Added to Existing Function
This rule was missing alerts for the `UpdateFunctionConfiguration` action due to a missing wildcard.
- added missing wildcard to query
- reduced execution window
- updated description, FP and IG sections
- added highlighted fields
#### AWS Lambda Function Policy Updated to Allow Public Invocation
- changed this query to use EQL instead of KQL to optimize wildcard usage
- uses `event.type` as `event_category_override`
- reduced execution window
- updated description, FP and IG sections
- added highlighted fields
Copy file name to clipboardExpand all lines: rules/integrations/aws/execution_lambda_external_layer_added_to_function.toml
+75-32Lines changed: 75 additions & 32 deletions
Original file line number
Diff line number
Diff line change
@@ -2,58 +2,84 @@
2
2
creation_date = "2024/04/30"
3
3
integration = ["aws"]
4
4
maturity = "production"
5
-
updated_date = "2025/01/15"
5
+
updated_date = "2025/12/11"
6
6
7
7
[rule]
8
8
author = ["Elastic"]
9
9
description = """
10
-
Identifies when an Lambda Layer is added to an existing Lambda function. AWS layers are a way to share code and data
11
-
across multiple functions. By adding a layer to an existing function, an attacker can persist or execute code in the
12
-
context of the function.
10
+
Identifies when a Lambda layer is added to an existing AWS Lambda function. Lambda layers allow shared code,
11
+
dependencies, or runtime modifications to be injected into a function’s execution environment. Adversaries with the
12
+
ability to update function configurations may add a malicious layer to establish persistence, run unauthorized code, or
13
+
intercept data handled by the function. This activity should be reviewed to ensure the modification is expected and
14
+
authorized.
13
15
"""
14
-
false_positives = ["Lambda function owners may add layers to their functions for legitimate purposes."]
15
-
from = "now-60m"
16
+
false_positives = [
17
+
"""
18
+
Lambda function owners or deployment pipelines may legitimately add or update layers as part of normal development
19
+
and maintenance workflows. Confirm that the layer addition aligns with approved changes, expected CI/CD behavior, or
20
+
routine dependency updates. Known automation roles or build systems can be excluded if they consistently perform
21
+
authorized modifications.
22
+
""",
23
+
]
24
+
from = "now-6m"
16
25
index = ["filebeat-*", "logs-aws.cloudtrail-*"]
17
-
interval = "10m"
18
26
language = "kuery"
19
27
license = "Elastic License v2"
20
28
name = "AWS Lambda Layer Added to Existing Function"
21
-
note = """
22
-
## Triage and analysis
29
+
note = """## Triage and analysis
30
+
31
+
> **Disclaimer**:
32
+
> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance.
33
+
> While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
23
34
24
35
### Investigating AWS Lambda Layer Added to Existing Function
25
36
26
-
This rule detects when a Lambda layer is added to an existing Lambda function. AWS Lambda layers are a mechanism for sharing code and data across multiple functions. By adding a layer to an existing function, an attacker can persist or execute code in the context of the function. Understanding the context and legitimacy of such changes is crucial to determine if the action is benign or malicious.
37
+
Lambda layers introduce external code artifacts into a function’s runtime. Adding a layer to an existing Lambda function
38
+
modifies its execution environment and may allow an adversary to run arbitrary code, intercept data, or maintain
39
+
persistence without altering the function source itself. This detection highlights successful configuration updates using
40
+
`PublishLayerVersion*` or `UpdateFunctionConfiguration*`.
41
+
42
+
### Possible investigation steps
27
43
28
-
#### Possible Investigation Steps:
44
+
**Identify the actor**
45
+
- Review `aws.cloudtrail.user_identity.arn` and the `access_key_id`. Determine whether the actor normally administers Lambda or has recently exhibited unusual behavior.
29
46
30
-
- **Identify the Actor**: Review the `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.access_key_id` fields to identify who made the change. Verify if this actor typically performs such actions and if they have the necessary permissions.
31
-
- **Review the Request Details**: Examine the `aws.cloudtrail.request_parameters` to understand the specific layer added to the Lambda function. Look for any unusual parameters that could suggest unauthorized or malicious modifications.
32
-
- **Analyze the Source of the Request**: Investigate the `source.ip` and `source.geo` fields to determine the geographical origin of the request. An external or unexpected location might indicate compromised credentials or unauthorized access.
33
-
- **Contextualize with Timestamp**: Use the `@timestamp` field to check when the change occurred. Modifications during non-business hours or outside regular maintenance windows might require further scrutiny.
34
-
- **Correlate with Other Activities**: Search for related CloudTrail events before and after this change to see if the same actor or IP address engaged in other potentially suspicious activities.
47
+
**Review what was modified**
48
+
- Inspect `aws.cloudtrail.request_parameters` to identify which layer ARN was added, the function name and region, whether multiple layers were applied at once or in rapid succession.
49
+
- Compare the added layer version against known and approved layer catalogs.
35
50
36
-
### False Positive Analysis:
51
+
**Validate the operational context**
52
+
- Check the time of the update (`@timestamp`) to see if it aligns with known release pipelines or deployment windows and Normal working hours for the responsible team.
53
+
- Determine whether a CI/CD pipeline or IaC tool was expected to update this function.
37
54
38
-
- **Legitimate Administrative Actions**: Confirm if the addition of the Lambda layer aligns with scheduled updates, development activities, or legitimate administrative tasks documented in change management systems.
39
-
- **Consistency Check**: Compare the action against historical data of similar actions performed by the user or within the organization. If the action is consistent with past legitimate activities, it might indicate a false alarm.
40
-
- **Verify through Outcomes**: Check the `aws.cloudtrail.response_elements` and the `event.outcome` to confirm if the change was successful and intended according to policy.
55
+
**Assess where the change came from**
56
+
- Review `source.ip` and `user_agent.original` for signs of console access from unusual locations, access via previously unused automation tools, suspicious programmatic access consistent with compromised keys.
41
57
42
-
### Response and Remediation:
58
+
**Correlate with additional activity**
59
+
- Look for preceding or subsequent events such as:
60
+
- Creation of new Lambda layers (`PublishLayerVersion`).
61
+
- IAM role modifications affecting the Lambda function.
62
+
- Increased invocation volume or unusual invocation patterns after the layer addition.
63
+
- Search for other functions modified by the same actor or from the same IP.
43
64
44
-
- **Immediate Review and Reversal if Necessary**: If the change was unauthorized, remove the added layer from the Lambda function to mitigate any unintended code execution or persistence.
45
-
- **Enhance Monitoring and Alerts**: Adjust monitoring systems to alert on similar actions, especially those involving sensitive functions or layers.
46
-
- **Educate and Train**: Provide additional training to users with administrative rights on the importance of security best practices concerning Lambda function management and the use of layers.
47
-
- **Audit Lambda Functions and Policies**: Conduct a comprehensive audit of all Lambda functions and associated policies to ensure they adhere to the principle of least privilege.
48
-
- **Incident Response**: If there's an indication of malicious intent or a security breach, initiate the incident response protocol to mitigate any damage and prevent future occurrences.
65
+
### False positive analysis
49
66
50
-
### Additional Information:
67
+
- Confirm whether the change aligns with a planned deployment, application update, or dependency upgrade.
68
+
- Determine whether the user or automation role commonly modifies Lambda function configurations.
69
+
- Validate the legitimacy of the added layer by checking internal documentation or release notes.
51
70
52
-
For further guidance on managing Lambda functions and securing AWS environments, refer to the [AWS Lambda documentation](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) and AWS best practices for security. Additionally, consult the following resources for specific details on Lambda layers and persistence techniques:
0 commit comments