AWS CloudTrail: CreateFunctionUrlConfig Indicates Lambda Function URL Added

title: "AWS CloudTrail: CreateFunctionUrlConfig Indicates Lambda Function URL Added"
id: 6aef5525-e934-4692-a642-3b588e495999
status: experimental
description: This rule identifies CloudTrail events where a user creates a Lambda function URL configuration. Exposing a function via a public URL can enable unintended access paths and may allow an attacker to leverage the Lambda function’s associated permissions when combined with other conditions. The detection relies on AWS CloudTrail telemetry capturing eventSource=lambda.amazonaws.com and eventName=CreateFunctionUrlConfig.
references:
  - https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
  - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
  - https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_lambda_function_url.yml
author: Ivan Saakov, Huntrule Team
date: 2024-12-19
tags:
  - attack.initial-access
  - attack.privilege-escalation
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: lambda.amazonaws.com
    eventName: CreateFunctionUrlConfig
  condition: selection
falsepositives:
  - Creating a Lambda function URL configuration may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - Creating a Lambda function URL configuration from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: ec541962-c05a-4420-b9ea-84de072d18f4
    type: derived