A cloud function was created with an unusual runtime

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2024-12-03

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059)
Severity	Low

A cloud function was created with an unusual runtime.

Abuse organization resources, keep persistence on the account.

Investigate the lambda code implementation and look for abnormal calls.
Look for any abnormal actions made in the same project before and after the incident.

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059)
Severity	Informational

A cloud function was created with an unusual runtime.

Abuse organization resources, keep persistence on the account.

Investigate the lambda code implementation and look for abnormal calls.
Look for any abnormal actions made in the same project before and after the incident.

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059)
Severity	Low

A cloud function was created with an unusual runtime.

Abuse organization resources, keep persistence on the account.

Investigate the lambda code implementation and look for abnormal calls.
Look for any abnormal actions made in the same project before and after the incident.

ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	Command and Scripting Interpreter (T1059)
Severity	Medium

A cloud function was created with an unusual runtime.

Abuse organization resources, keep persistence on the account.

Investigate the lambda code implementation and look for abnormal calls.
Look for any abnormal actions made in the same project before and after the incident.