Serverless Execution

Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.

Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. Resource Hijacking).[1] Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the IAM:PassRole permission in AWS or the iam.serviceAccounts.actAs permission in Google Cloud to add Additional Cloud Roles to a serverless cloud function, which may then be able to perform actions the original user cannot.[2][3]

Serverless functions can also be invoked in response to cloud events (i.e. Event Triggered Execution), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds Additional Cloud Credentials to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.[4] Similarly, an adversary may create a Power Automate workflow in Office 365 environments that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.[5][6]

ID: T1648
Sub-techniques:  No sub-techniques
Tactic: Execution
Platforms: IaaS, Office 365, SaaS
Contributors: Alex Soler, AttackIQ; Cisco; Oleg Kolesnikov, Securonix; Praetorian; Shailesh Tiwary (Indian Army); Varonis Threat Labs
Version: 1.0
Created: 27 May 2022
Last Modified: 24 October 2022

Procedure Examples

ID Name Description
S1091 Pacu

Pacu can create malicious Lambda functions.[7]

Mitigations

ID Mitigation Description
M1018 User Account Management

Remove permissions to create, modify, or run serverless resources from users that do not explicitly require them.

Detection

ID Data Source Data Component Detects
DS0015 Application Log Application Log Content

Monitor logs generated by serverless execution for unusual activity. For example, in Exchange environments emails sent by Power Automate via the Outlook 365 connector include the phrase ‘Power App’ or ‘Power Automate’ in the SMTP header 'x-ms-mail-application.'[8]

DS0025 Cloud Service Cloud Service Modification

Monitor the creation and modification of serverless resources such as functions and workflows.

References