Identifies when an unusual user deletes an AWS Lambda function. Deleting a function removes its code, configuration, versions, and aliases. Adversaries may delete functions to disrupt business operations and automated workflows, to destroy attacker-deployed backdoors and remove evidence after achieving their objective, or to inhibit incident response. Because function deletion is destructive and often irreversible without redeployment, deletions performed by unexpected principals or outside change windows should be reviewed. This is a New Terms rule that uses "cloud.account.id", "user.name", and "aws.cloudtrail.flattened.request_parameters.functionName" to alert on the first time a given identity in an account successfully deletes a specific Lambda function within the history window.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.