AWS CloudTrail: Lambda Function URL Configuration Created

title: "AWS CloudTrail: Lambda Function URL Configuration Created"
id: 6aef5525-e934-4692-a642-3b588e495999
status: experimental
description: This rule identifies CloudTrail events where an actor creates a Lambda Function URL configuration (eventName CreateFunctionUrlConfig). Exposing a function via a Function URL can increase access paths to the Lambda endpoint and may allow misuse of the associated execution role permissions. The detection relies on AWS CloudTrail telemetry that records the Lambda API call with eventSource lambda.amazonaws.com and eventName CreateFunctionUrlConfig.
references:
  - https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
  - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
  - https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_lambda_function_url.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-19
tags:
  - attack.initial-access
  - attack.privilege-escalation
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: lambda.amazonaws.com
    eventName: CreateFunctionUrlConfig
  condition: selection
falsepositives:
  - Creating a Lambda function URL configuration may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Creating a Lambda function URL configuration from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: ec541962-c05a-4420-b9ea-84de072d18f4
    type: derived