Elastic Security Detection Rules

AWS Lambda Function Invoked from an Unusual Source ASN

Last updated 2 months ago on 2026-06-18
Created 2 months ago on 2026-06-18

About

Identifies an AWS Lambda function invoked directly by a principal from a source network (ASN) not seen for that principal in the prior 10 days, excluding common cloud provider networks. Direct invocation from an unfamiliar external network can indicate use of stolen execution-role or user credentials from attacker-controlled infrastructure to execute functions or retrieve the data they return. This rule relies on AWS Lambda data event logging, which is not enabled by default.
Tags
Domain: CloudData Source: AWSData Source: Amazon Web ServicesData Source: AWS LambdaUse Case: Threat DetectionTactic: ExecutionLanguage: kuery
Severity
medium
Risk Score
47
MITRE ATT&CK™

Execution (TA0002)(external, opens in a new tab or window)

↳ Serverless Execution (T1648)(external, opens in a new tab or window)

False Positive Examples
Operators and automation may legitimately invoke functions from new networks (new offices, VPNs, home IPs, or new egress infrastructure). Verify the principal in `aws.cloudtrail.user_identity.arn`, the source network, and the function, and exclude known operator networks or identities after validation.
License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
New Terms Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-aws.cloudtrail-*
Related Integrations

aws(external, opens in a new tab or window)

Query
text code block:
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.action: Invoke*
    and event.outcome: "success"
    and not aws.cloudtrail.user_identity.invoked_by: *
    and source.as.organization.name:(* and not (Amazon* or AMAZON* or Google* or GOOGLE* or Microsoft* or MICROSOFT*))

Install detection rules in Elastic Security

Detect AWS Lambda Function Invoked from an Unusual Source ASN in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).