Elastic Security Detection Rules

AWS Lambda Function High-Frequency Invocation by a Single Principal

Last updated 2 months ago on 2026-06-18
Created 2 months ago on 2026-06-18

About

Identifies a single principal directly invoking AWS Lambda functions at a high volume within a one-hour window. Adversaries may drive excessive invocations to abuse functions for resource hijacking or cryptomining, to inflate costs in a denial-of-wallet attack, or to enumerate function behavior. This is a volumetric heuristic: the threshold is environment-dependent and high-throughput applications can exceed it, so tune it to the deployment. This rule relies on AWS Lambda data event logging, which is not enabled by default.
Tags
Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: AWS CloudTrailData Source: AWS LambdaUse Case: Threat DetectionTactic: ImpactLanguage: esql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Impact (TA0040)(external, opens in a new tab or window)

↳ Resource Hijacking (T1496)(external, opens in a new tab or window)

False Positive Examples
Legitimate high-throughput applications, batch jobs, load tests, and automation can invoke functions at high volume and will exceed any fixed threshold. Validate the principal in `aws.cloudtrail.user_identity.arn` and the workload context, and tune the threshold to the environment.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

aws(external, opens in a new tab or window)

Query
text code block:
from logs-aws.cloudtrail-*

// Lambda invocation data events (data-plane; requires data event logging enabled)
| where
    event.provider == "lambda.amazonaws.com"
    and event.action like "Invoke*"
    and event.outcome == "success"
    and aws.cloudtrail.user_identity.arn IS NOT NULL

| stats
    Esql.invocation_count = count(*),
    Esql.source_ips = values(source.ip)
  by
    aws.cloudtrail.user_identity.arn

// Threshold is environment-dependent — tune to the deployment
| where Esql.invocation_count >= 1000

| keep
    aws.cloudtrail.user_identity.arn,
    Esql.invocation_count,
    Esql.source_ips

| sort Esql.invocation_count desc

Install detection rules in Elastic Security

Detect AWS Lambda Function High-Frequency Invocation by a Single Principal in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).