tfMITRE ATT&CK sub-technique

Serverless T1584.007

sub-technique of T1584 Compromise Infrastructure

Tactic: Resource Development
Platform: PRE
Version: 1.1
Created: 08 July 2022
Last modified: 15 April 2025
Contributor: Awake Security

Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1584.007

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Serverless detection strategy DET0864

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Serverless

Enterprise

1 platform

AN1996 · PRE

Once adversaries leverage serverless functions as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on related stages of the adversary lifecycle.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Response ContentDC0104	Internet Scan	None

Serverless detections T1584.007

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs