Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
5 Days |
Required Data |
|
Detection Modules |
Cloud |
Detector Tags |
|
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Low |
Description
A cloud function was created with an unusual runtime.
Attacker's Goals
Execute arbitrary code in cloud environments.
Investigative actions
- Examine the cloud function's code implementation and look for any unusual invocations.
- Check for any unusual activities within the same project.
Variations
A cloud function was created with an unusual runtime by a known cloud identityA cloud function was created with a runtime that was not seen in the organization
A cloud function was created with a custom runtime