Analytics BIOC
Informational
✕
An AWS Lambda Function was created
An AWS Lambda Function was created.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Execution (TA0002) Persistence (TA0003)
ATT&CK techniques: Serverless Execution (T1648) Scheduled Task/Job: Scheduled Task (T1053.005)
Attacker's goals:
Execute malicious code on AWS using Lambda functions.* Maintain persistence on AWS Lambda by creating or invoking Lambda functions.
Investigative actions:
Identify the Lambda function that was created and analyze its code for any malicious activity.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days