Possible AWS New Lambda Layer Attached (via cloudtrail)

title: Possible AWS New Lambda Layer Attached (via cloudtrail)
id: 031f273a-4376-5643-ad59-9571c8fe496d
status: stable
description: This rule detects when a user attached a Lambda layer to an existing Lambda function. A hostile Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.
references:
    - https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html
    - https://github.com/clearvector/lambda-spy
author: Huntrule Team
date: 2026-01-24
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.t1648
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: lambda.amazonaws.com
        eventName|startswith: 'UpdateFunctionConfiguration'
        requestParameters.layers|contains: '*'
    condition: selection
falsepositives:
    - Unknown
level: low