Attack Chain

1. Initial Access: An adversary gains initial access to an AWS account, potentially through compromised credentials or exploitation of a vulnerable application.
2. Privilege Escalation/Reconnaissance: The adversary identifies or escalates privileges to a role with lambda:CreateEventSourceMapping permissions and lambda:CreateFunction/lambda:UpdateFunctionCode or similar permissions to deploy/modify Lambda functions.
3. Deploy Malicious Lambda Function: The adversary deploys a new Lambda function or modifies an existing one to include malicious code designed for persistence or data exfiltration.
4. Identify Sensitive Event Source: The adversary identifies an existing event source (e.g., an Amazon SQS queue, Kinesis stream, or DynamoDB stream) containing sensitive data or frequently processed events.
5. Create Event Source Mapping: Using lambda:CreateEventSourceMapping, the adversary creates a mapping connecting the identified sensitive event source to their malicious Lambda function.
6. Event Triggered Execution: As new records arrive in the event source, the malicious Lambda function is automatically invoked in the background.
7. Persistence/Data Exfiltration: The malicious Lambda function executes, maintaining persistence by processing future events, or exfiltrating sensitive data from the event stream to an attacker-controlled destination.
8. Obfuscation: The adversary may attempt to obscure the purpose of the mapping or blend it with legitimate system activity to avoid detection.

Impact

Successful exploitation of this technique can lead to severe consequences, including continuous data exfiltration of sensitive information processed by the compromised AWS environment. For instance, if an SQS queue handling customer data or a Kinesis stream processing financial transactions is mapped, adversaries can silently siphon this data over an extended period. This method establishes a highly stealthy and durable persistence mechanism, making it difficult for defenders to detect and eradicate. The event-driven nature of Lambda functions also means the malicious code executes autonomously, requiring minimal further attacker interaction, thus reducing the chances of interactive C2 detection.

Recommendation

• Deploy the Sigma rule "AWS Lambda Event Source Mapping Creation" in this brief to your SIEM and tune for your environment to detect suspicious CreateEventSourceMapping calls.
• Restrict lambda:CreateEventSourceMapping permissions to only trusted roles and automated deployment pipelines, referencing the AWS documentation on API permissions.
• Investigate all alerts from the "AWS Lambda Event Source Mapping Creation" rule, paying close attention to aws.cloudtrail.user_identity.arn, functionName, and eventSourceArn to determine legitimacy.
• Regularly audit existing AWS Lambda event source mappings to identify any unauthorized or suspicious configurations, focusing on the target function and event source involved.