AWS New Lambda Layer Attached

Status: test
Severity: low
Log source: product aws, service cloudtrail
Author: Austin Songer
Source: github.com/SigmaHQ/sigma

Detects when a user attached a Lambda layer to an existing Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.

Known false positives

Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	No specific technique

Telemetry coverage

Platform	Record / event type
AWS	CloudTrail event `any`: Catch-all entry for AWS Lambda rules that match the service but not a specific eventName.

Rules detecting the same action

These rules filter on the same operation.

AWS Discovery API Calls via CLI from a Single Resource (Elastic)
AWS Lambda Event Source Mapping Creation (Elastic)
AWS Lambda Function Created or Updated (Elastic)
AWS Lambda Function High-Frequency Invocation by a Single Principal (Elastic)
AWS Lambda Function Invoked by an Unusual Principal (Elastic)
AWS Lambda Function Invoked Cross-Account (Elastic)
AWS Lambda Function Invoked from an Unusual Source ASN (Elastic)
AWS Lambda Function Policy Updated to Allow Cross-Account Invocation (Elastic)

Rule body

title: AWS New Lambda Layer Attached
id: 97fbabf8-8e1b-47a2-b7d5-a418d2b95e3d
status: test
description: |
  Detects when a user attached a Lambda layer to an existing Lambda function.
  A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
  This would give an adversary access to resources that the function has access to.
references:
    - https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html
    - https://github.com/clearvector/lambda-spy
author: Austin Songer
date: 2021-09-23
modified: 2025-03-17
tags:
    - attack.privilege-escalation
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: lambda.amazonaws.com
        eventName|startswith: 'UpdateFunctionConfiguration'
        requestParameters.layers|contains: '*'
    condition: selection
falsepositives:
    - Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: lambda.amazonaws.com
    eventName|startswith: 'UpdateFunctionConfiguration'
    requestParameters.layers|contains: '*'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	starts_with	`UpdateFunctionConfiguration`	`field:"aws::eventName" kind:starts_with value:"UpdateFunctionConfiguration"`
`eventSource`	eq	`lambda.amazonaws.com`	`field:"aws::eventSource" kind:eq value:"lambda.amazonaws.com"`
`requestParameters.layers`	match	`*`	`field:"requestParameters.layers" kind:match value:"*"`