An AWS Lambda function was modified

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Serverless Execution (T1648)
Severity	Informational

Description

An AWS Lambda function was modified.

Attacker's Goals

Modification of Lambda functions may provide attackers access to run code against cloud environments.

Investigative actions

• Check what modifications were made to the AWS Lambda function.