Detection of Anomalous Direct AWS Lambda Function Invocations

Adversaries who obtain cloud credentials may perform direct invocations of AWS Lambda functions to execute code, exfiltrate data, or move laterally within an AWS account. Unlike standard event-driven invocations triggered by AWS services (such as S3 or EventBridge), which are excluded from this detection pattern, direct invocations via the CLI, SDK, or management console are rare and often indicate reconnaissance or exploitation. This behavior is significant because Lambda functions frequently operate with over-permissioned execution roles, providing attackers an avenue to interact with other cloud services. Defenders should monitor for direct 'Invoke' calls from principals that do not typically interact with the Lambda service to identify potential credential abuse or unauthorized ad-hoc execution. This detection relies on AWS CloudTrail data-plane logging, which must be explicitly enabled for Lambda, as it is not active by default.

Impact

Successful abuse of Lambda functions can lead to unauthorized data retrieval, sensitive code execution, and escalation of privileges through inherited IAM roles. Organizations may face significant data exposure if functions process sensitive information, or attackers may use functions as a launchpad for further internal cloud resource compromise.

Recommendation

• Enable AWS CloudTrail data event logging specifically for Lambda functions to ensure the 'Invoke' action is recorded.
• Implement the provided detection logic in your SIEM to monitor for 'Invoke' calls from identities that lack a historical record of such activity in the past 14 days.
• Review CloudTrail logs for unexpected usage of Lambda APIs by newly created or rarely used IAM roles and access keys.
• Constrain 'lambda:InvokeFunction' permissions using IAM policies to adhere to the principle of least privilege, restricting access to only necessary automated services and specific human operators.