AWS Lambda Layer Added to Existing Function

This detection identifies when a Lambda layer is added to an existing AWS Lambda function. Lambda layers enable shared code, dependencies, or runtime modifications to be injected into a function’s execution environment. Threat actors with the ability to update function configurations may add a malicious layer to establish persistence, execute unauthorized code, or intercept data handled by the function. The activity is detected via CloudTrail logs that record PublishLayerVersion* or UpdateFunctionConfiguration* events. Reviewing these actions is important to ensure that all modifications are expected and authorized. This activity can be used for initial access, persistence and defense evasion.

Attack Chain

1. An attacker gains unauthorized access to an AWS account with sufficient permissions to modify Lambda function configurations.
2. The attacker identifies a target Lambda function to compromise.
3. The attacker creates a malicious Lambda layer containing malicious code or dependencies.
4. The attacker uses the PublishLayerVersion API call to publish the malicious layer to AWS.
5. The attacker uses the UpdateFunctionConfiguration API call to add the newly published layer to the target Lambda function's configuration.
6. The Lambda function is invoked, triggering the execution of the malicious code within the added layer.
7. The malicious code performs unauthorized actions, such as data exfiltration or establishing a reverse shell.

Impact

Successful exploitation can lead to unauthorized code execution within the Lambda function's execution environment. This can compromise sensitive data, disrupt services, or establish persistence within the AWS environment. The modification of Lambda functions can be difficult to detect without proper monitoring.

Recommendation

• Deploy the Sigma rule "AWS Lambda Layer Added to Existing Function" to detect suspicious modifications to Lambda function configurations (see rules section).
• Monitor AWS CloudTrail logs for PublishLayerVersion* and UpdateFunctionConfiguration* events to identify potentially malicious layer additions.
• Implement strict IAM policies to limit the ability to modify Lambda function configurations and publish new layers.
• Regularly review Lambda function configurations to ensure that all layers are authorized and legitimate.
• Investigate any modifications to Lambda function configurations that do not align with approved changes or expected CI/CD behavior, referencing the investigation fields from the original source.