Suspicious Creation of New AWS Lambda Function URL Configuration (via cloudtrail)

title: Suspicious Creation of New AWS Lambda Function URL Configuration (via cloudtrail)
id: bcafaf81-408c-5706-aa2c-6869f56ef508
status: stable
description: This rule detects when a user generates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially enable unauthorized access to the function's IAM role for AWS API calls. This could give an adversary access to the privileges linked with the Lambda service role that is attached to that function.
references:
    - https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
    - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
    - https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
author: Huntrule Team
date: 2026-01-14
tags:
    - attack.initial-access
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1133
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: lambda.amazonaws.com
        eventName: 'CreateFunctionUrlConfig'
    condition: selection
falsepositives:
    - Unknown
level: medium