Serverless Execution `T1648`

Tactic: Execution

Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.

Authoring guide

These 17 rules share fields, values, and exclusions.

Fields filtered most (23 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	11	`starts_with` 7, `eq` 2, `in` 1, `is_not_null` 1	`Invoke`, `AddLayerVersionPermission`, `CreateEventSourceMapping`, `CreateFunction`, `PublishLayerVersion`
`data_stream.dataset`	9	`eq` 9	`aws.cloudtrail`, `github.audit`, `azure.activitylogs`
`event.outcome`	9	`eq` 9	`success`
`Provider_Name`	8	`eq` 8	`lambda.amazonaws.com`, `cloudformation.amazonaws.com`
`event.dataset`	6	`eq` 6	`github.audit`, `aws.cloudtrail`
`event.category`	5	`eq` 5	`configuration`
`github.repository_public`	4	`eq` 4	`false`
`aws::userIdentity.invokedBy`	3	`is_null` 3
`github.programmatic_access_type`	3	`in` 3	`fine-grained personal access token`, `oauth access token`
`github.repo`	3	`is_not_null` 3
`aws::userIdentity.arn`	2	`is_not_null` 2
`github.hashed_token`	2	`is_not_null` 2
`Esql.caller_account`	1	`is_not_null` 1, `ne` 1	`esql.function_account`
`Esql.function_account`	1	`is_not_null` 1
`EventID`	1	`regex_match` 1	`UpdateFunctionCode`

Top indicator values (31 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Function Created or Updated elasticAWS Lambda Function Invoked by an Unusual Principal elasticAWS Lambda Function Invoked Cross-Account elasticAWS Lambda Function Invoked from an Unusual Source ASN elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally elasticAzure Automation Runbook Created or Modified elasticFirst Time AWS CloudFormation Stack Creation	9	369
`Provider_Name`	`eq`	`lambda.amazonaws.com` elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Function Created or Updated elasticAWS Lambda Function Invoked by an Unusual Principal elasticAWS Lambda Function Invoked Cross-Account elasticAWS Lambda Function Invoked from an Unusual Source ASN elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally	7	12
`Provider_Name`	`eq`	`cloudformation.amazonaws.com` elasticFirst Time AWS CloudFormation Stack Creation	1
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Lambda Event Source Mapping Creation elasticAWS Lambda Function Invoked by an Unusual Principal elasticAWS Lambda Function Invoked from an Unusual Source ASN elasticAWS Lambda Layer Added to Existing Function elasticAWS Lambda Layer Shared Externally elasticFirst Time AWS CloudFormation Stack Creation	6	169
`data_stream.dataset`	`eq`	`github.audit` elasticGitHub App Deleted elasticHigh Number of Cloned GitHub Repos From PAT	2	18
`data_stream.dataset`	`eq`	`azure.activitylogs` elasticAzure Automation Runbook Created or Modified	1	39
`event.category`	`eq`	`configuration` elasticFirst Occurrence GitHub Event for a Personal Access Token (PAT) elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo elasticFirst Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT) elasticHigh Number of Cloned GitHub Repos From PAT	5	13
`event.dataset`	`eq`	`github.audit` elasticFirst Occurrence GitHub Event for a Personal Access Token (PAT) elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo elasticFirst Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT) elasticGitHub Repo Created	5	14
`event.dataset`	`eq`	`aws.cloudtrail` elasticAWS Lambda Function Created or Updated	1	17
`github.repository_public`	`eq`	`false` elasticFirst Occurrence of GitHub Repo Interaction From a New IP elasticFirst Occurrence of GitHub User Interaction with Private Repo elasticFirst Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT) elasticHigh Number of Cloned GitHub Repos From PAT	4	5
`EventType`	`starts_with`	`Invoke` elasticAWS Lambda Function Invoked by an Unusual Principal elasticAWS Lambda Function Invoked Cross-Account elasticAWS Lambda Function Invoked from an Unusual Source ASN	3	4
`EventType`	`starts_with`	`AddLayerVersionPermission` elasticAWS Lambda Layer Shared Externally	1
`EventType`	`starts_with`	`CreateEventSourceMapping` elasticAWS Lambda Event Source Mapping Creation	1
`EventType`	`starts_with`	`CreateFunction` elasticAWS Lambda Function Created or Updated	1
`EventType`	`starts_with`	`PublishLayerVersion` elasticAWS Lambda Layer Added to Existing Function	1
`EventType`	`starts_with`	`UpdateFunctionCode` elasticAWS Lambda Function Created or Updated	1
`EventType`	`starts_with`	`UpdateFunctionConfiguration` elasticAWS Lambda Layer Added to Existing Function	1
`github.programmatic_access_type`	`in`	`fine-grained personal access token` elasticFirst Occurrence GitHub Event for a Personal Access Token (PAT) elasticFirst Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT) elasticHigh Number of Cloned GitHub Repos From PAT	3	6
`github.programmatic_access_type`	`in`	`oauth access token` elasticFirst Occurrence GitHub Event for a Personal Access Token (PAT) elasticFirst Occurrence of Private Repo Event from Specific GitHub Personal Access Token (PAT) elasticHigh Number of Cloned GitHub Repos From PAT	3	6
`Esql.caller_account`	`ne`	`esql.function_account` elasticAWS Lambda Function Invoked Cross-Account	1
`EventID`	`regex_match`	`UpdateFunctionCode` chronicleAWS Lambda Update Function Code	1
`EventType`	`eq`	`git.clone` elasticHigh Number of Cloned GitHub Repos From PAT	1	2
`EventType`	`eq`	`repo.create` elasticGitHub Repo Created	1
`EventType`	`in`	`createstack` elasticFirst Time AWS CloudFormation Stack Creation	1
`EventType`	`in`	`createstackinstances` elasticFirst Time AWS CloudFormation Stack Creation	1
`azure.activitylogs.operation_name`	`in`	`microsoft.automation/automationaccounts/runbooks/draft/write` elasticAzure Automation Runbook Created or Modified	1
`azure.activitylogs.operation_name`	`in`	`microsoft.automation/automationaccounts/runbooks/publish/action` elasticAzure Automation Runbook Created or Modified	1
`azure.activitylogs.operation_name`	`in`	`microsoft.automation/automationaccounts/runbooks/write` elasticAzure Automation Runbook Created or Modified	1
`event.type`	`eq`	`deletion` elasticGitHub App Deleted	1	16
`github.category`	`eq`	`integration_installation` elasticGitHub App Deleted	1

Exclusions (6 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`source.as.organization.name`	`starts_with`	`AMAZON` elasticAWS Lambda Function Invoked from an Unusual Source ASN	1
`source.as.organization.name`	`starts_with`	`Amazon` elasticAWS Lambda Function Invoked from an Unusual Source ASN	1
`source.as.organization.name`	`starts_with`	`GOOGLE` elasticAWS Lambda Function Invoked from an Unusual Source ASN	1
`source.as.organization.name`	`starts_with`	`Google` elasticAWS Lambda Function Invoked from an Unusual Source ASN	1
`source.as.organization.name`	`starts_with`	`MICROSOFT` elasticAWS Lambda Function Invoked from an Unusual Source ASN	1
`source.as.organization.name`	`starts_with`	`Microsoft` elasticAWS Lambda Function Invoked from an Unusual Source ASN	1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Cloud

Elastic 16 rules

YARA-L 1 rule

AWS Lambda Update Function Code

Serverless Execution T1648