AWS CloudTrail Detects Lambda Layer Attach via UpdateFunctionConfiguration

Flags CloudTrail UpdateFunctionConfiguration calls that attach Lambda layers to an existing function.

FreeUnreviewedSigmalowv1

aws-cloudtrail-detects-lambda-layer-attach-via-updatefunctionconfiguration-97fbabf8

title: AWS CloudTrail Detects Lambda Layer Attach via UpdateFunctionConfiguration
id: 5914348f-4de7-4a1e-a3b0-11c4ddb43d3c
status: test
description: This rule matches AWS CloudTrail events where a user updates an existing Lambda function configuration and includes a change to the Lambda layers parameter. Attaching a new layer can allow code to run in the context of the function, potentially inheriting the permissions associated with the function's IAM role. The detection relies on CloudTrail telemetry for Lambda API calls and checks for UpdateFunctionConfiguration requests that contain a layers value.
references:
  - https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html
  - https://github.com/clearvector/lambda-spy
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_new_lambda_layer_attached.yml
author: Austin Songer, Huntrule Team
date: 2021-09-23
modified: 2025-03-17
tags:
  - attack.privilege-escalation
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: lambda.amazonaws.com
    eventName|startswith: UpdateFunctionConfiguration
    requestParameters.layers|contains: "*"
  condition: selection
falsepositives:
  - Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 97fbabf8-8e1b-47a2-b7d5-a418d2b95e3d
    type: derived

What it detects

This rule matches AWS CloudTrail events where a user updates an existing Lambda function configuration and includes a change to the Lambda layers parameter. Attaching a new layer can allow code to run in the context of the function, potentially inheriting the permissions associated with the function's IAM role. The detection relies on CloudTrail telemetry for Lambda API calls and checks for UpdateFunctionConfiguration requests that contain a layers value.

Known false positives

Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.