Analytics BIOC
Low
✕
A cloud function was created with an unusual runtime
A cloud function was created with an unusual runtime.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log, Gcp Audit Log
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Serverless Execution (T1648)
Attacker's goals:
Execute arbitrary code in cloud environments.
Investigative actions:
Examine the cloud function's code implementation and look for any unusual invocations. Check for any unusual activities within the same project.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
3 variations:
- A cloud function was created with an unusual runtime by a known cloud identity Informational (parent: Low)
- A cloud function was created with a runtime that was not seen in the organization Low
- A cloud function was created with a custom runtime Medium (parent: Low)