Detection rules › By event

AWS-lambda

Event	Rules
any	13
AddPermission	2
CreateFunction	1
CreateFunctionUrlConfig	1
ListFunctions	1
UpdateFunctionConfiguration	2
CreateAlias	1
CreateEventSourceMapping	1
DeleteAlias	1
DeleteEventSourceMapping	1
DeleteFunction	2
ListAliases	1
PublishVersion	1
RemovePermission	1
UpdateAlias	1
UpdateEventSourceMapping	1
UpdateFunctionCode	3

any

13 detection rules reference this event. View event page.

Sigma (1)

AWS New Lambda Layer Attached severity low

Elastic (11)

AWS Lambda Event Source Mapping Creation severity low T1546, T1578, T1578.005, T1648
AWS Lambda Function Created or Updated severity low building block T1648
AWS Lambda Function High-Frequency Invocation by a Single Principal severity medium T1496
AWS Lambda Function Invoked by an Unusual Principal severity medium T1648
AWS Lambda Function Invoked Cross-Account severity medium T1648
AWS Lambda Function Invoked from an Unusual Source ASN severity medium T1648
AWS Lambda Function Policy Updated to Allow Cross-Account Invocation severity high T1546, T1578, T1578.005
AWS Lambda Function Policy Updated to Allow Public Invocation severity high T1546, T1578, T1578.005
AWS Lambda Function URL Created with Public Access severity high T1133, T1578, T1578.005
AWS Lambda Layer Added to Existing Function severity low T1578, T1578.005, T1648
AWS Lambda Layer Shared Externally severity medium T1578, T1578.005, T1648

Panther (1)

Lambda Code Updated by User severity high T1078

AddPermission

2 detection rules reference this event. View event page.

Panther (2)

AWS Potential Backdoor Lambda Function Through Resource-Based Policy severity informational T1078
Lambda CRUD Actions severity high T1525

CreateFunction

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

CreateFunctionUrlConfig

1 detection rules reference this event. View event page.

Sigma (1)

New AWS Lambda Function URL Configuration Created severity medium

ListFunctions

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

UpdateFunctionConfiguration

2 detection rules reference this event. View event page.

Panther (2)

Lambda Configuration Updated with Layers by User severity high T1078
Lambda CRUD Actions severity high T1525

CreateAlias

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

CreateEventSourceMapping

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

DeleteAlias

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

DeleteEventSourceMapping

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

DeleteFunction

2 detection rules reference this event. View event page.

Elastic (1)

AWS Lambda Function Deletion severity low T1485, T1489

Panther (1)

Lambda CRUD Actions severity high T1525

ListAliases

1 detection rules reference this event. View event page.

Elastic (1)

AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

PublishVersion

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

RemovePermission

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

UpdateAlias

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

UpdateEventSourceMapping

1 detection rules reference this event. View event page.

Panther (1)

Lambda CRUD Actions severity high T1525

UpdateFunctionCode

3 detection rules reference this event. View event page.

Splunk (1)

AWS Lambda UpdateFunctionCode T1204

YARA-L (1)

AWS Lambda Update Function Code severity low T1648

Panther (1)

Lambda CRUD Actions severity high T1525