Analytics BIOC Low

A cloud function was created with an unusual runtime

A cloud function was created with an unusual runtime.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Gcp Audit Log
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Serverless Execution (T1648)
Attacker's goals:

Execute arbitrary code in cloud environments.

Investigative actions:

Examine the cloud function's code implementation and look for any unusual invocations. Check for any unusual activities within the same project.

Test period:
N/A (single event)
Deduplication:
5 Days
3 variations:
  • A cloud function was created with an unusual runtime by a known cloud identity Informational (parent: Low)
  • A cloud function was created with a runtime that was not seen in the organization Low
  • A cloud function was created with a custom runtime Medium (parent: Low)