- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
Detect when a IAM user modifies an AWS Lambda function. An attacker might modify a lambda function in order to maintain persistence or exfiltrate data being processed at runtime within an AWS environment.
This rule lets you monitor the UpdateFunctionCode
CloudTrail API call to detect when an AWS Lambda Function is modified.
{{@userIdentity.arn}}
is expected to update the Lambda function within the @requestParameters.functionName
attribute.{{@userIdentity.arn}}
and see if they made the API call.{{@userIdentity.arn}}
has taken other actions.{{@network.client.ip}}
.