Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

AWSCloudTrail - Lambda function code updated

Identifies IAM users updating Lambda function code via UpdateFunctionCode, which may indicate unauthorized code injection or persistence mechanism deployment.

ATT&CK coverage

Execution

T1053Scheduled Task/JobAlso under Persistence and Privilege Escalation.
- T1053.007Container Orchestration Job 5 detections cover this technique
T1059Command and Scripting Interpreter
- T1059.004Unix Shell 189 detections cover this technique
T1204User Execution 138 detections cover this technique

Detection requirements

Log source product: aws
Log source service: awscloudtrail

What the source says

Tagged by the source as

ExecutionPersistence

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.