name: AWS Lambda UpdateFunctionCode
id: 211b80d3-6340-4345-11ad-212bf3d0d111
version: 1
date: '2022-02-24'
author: Bhavin Patel, Splunk
type: Hunting
datamodel: []
description: This analytic is designed to detect IAM users attempting to update/modify AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS environment and to facilitate planting backdoors. 
search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode*  errorCode = success  user_type=IAMUser | stats  count min(_time) as firstTime max(_time) as lastTime  values(requestParameters.functionName) as function_updated by src_ip user_arn user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`'
how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
  search works with AWS CloudTrail logs.
known_false_positives: While this search has no known false positives, it is possible
  that an AWS admin or an autorized IAM user has updated the lambda code legitimately. 
references:
- http://detectioninthe.cloud/execution/modify_lambda_function_code/
- https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/
tags:
  analytic_story:
  - Suspicious Cloud User Activities
  asset_type: AWS Account
  automated_detection_testing: passed
  cis20:
  - CIS 13
  confidence: 90
  context:
  - Source:Cloud Data
  - Scope:External
  - Outcome:Allowed
  - Stage:Execution
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events.json
  impact: 70
  kill_chain_phases:
  - Actions on Objectives
  message: User $user_arn$ is attempting to create access keys for $requestParameters.userName$
    from this IP $src$
  mitre_attack_id:
  - T1204
  nist:
  - PR.DS
  - PR.AC
  - DE.CM
  observable:
  - name: src_ip
    type: IP Address
    role:
    - Attacker
  - name: user_arn
    type: User
    role:
    - Attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - eventName
  - userAgent
  - errorCode
  risk_score: 63
  security_domain: cloud