tfMITRE ATT&CK technique

Serverless Execution T1648

Tactic: Execution
Platforms: SaaS, IaaS, Office Suite
Version: 1.2
Created: 27 May 2022
Last modified: 15 April 2025
Contributors: Shailesh Tiwary (Indian Army); Praetorian; Oleg Kolesnikov, Securonix; Cisco; Varonis Threat Labs; Alex Soler, AttackIQ; Vectra AI; OWN

Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Serverless Execution MITRE reference T1648

44th pctamong all ATT&CK techniques for number of tools

1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

PacuS1091 ↗

Can create malicious Lambda functions.1

created 2023-09-28TOOL

All 1 software entries for this technique

Offense vs defense T1648

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Serverless Execution detection strategy DET0374

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Serverless Execution (T1648)

Enterprise

3 platforms

AN1053 · IaaS

Correlate creation or modification of serverless functions (e.g., AWS Lambda, GCP Cloud Functions, Azure Functions) with anomalous IAM role assignments or permissions escalation events. Detect subsequent executions of newly created functions that perform unexpected actions such as spawning outbound network connections, accessing sensitive resources, or creating additional credentials.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	AWS:CloudTrail	InvokeFunction: Unexpected or repeated invocation of functions not tied to known workflows
Cloud Service ModificationDC0069	AWS:CloudTrail	CreateFunction / UpdateFunctionConfiguration: Function creation, role assignment, or configuration change events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RoleScope	Which IAM roles or privileges are considered sensitive when applied to functions
AllowedFunctions	Known baseline list of approved serverless functions to reduce false positives
TimeWindow	Temporal threshold for correlating function creation with anomalous execution

AN1054 · Office Suite

Monitor for creation of new Power Automate flows or equivalent automation scripts that trigger on user or file events. Detect anomalous actions performed by these automations, such as email forwarding, anonymous link creation, or unexpected API calls to external endpoints.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	m365:exchange	New-InboxRule: Automation that triggers abnormal forwarding or external link generation
Cloud Service ModificationDC0069	m365:unified	AddFlow / UpdateFlow: New automation or workflow creation events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Business units or users where automation creation is expected (developers, admins)
FlowActions	Specific automation actions (email forwarding, file sharing) that should be considered suspicious

AN1055 · SaaS

Track creation or update of SaaS automation scripts (e.g., Google Workspace Apps Script). Detect when these scripts are bound to user events such as file opens or account modifications, and correlate with subsequent abnormal API calls that exfiltrate or modify user data.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	saas:googledrive	FileOpen / FileAccess: Event-driven script triggering on user file actions
Cloud Service ModificationDC0069	saas:appsscript	Create / Update: Deployment of scripts with event-driven triggers

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptScope	Which SaaS apps or APIs can be legitimately automated in the environment
TriggerTypes	Event-driven triggers (e.g., on file open, on user creation) considered suspicious

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformsiaas:aws

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Lambda Function Hijack

iaas:aws

PowerShell

—

Yes

Modify an existing Lambda function to execute arbitrary code.

Input arguments

Name	Type	Default	Description
region	string	us-east-2	AWS region to deploy the EC2 instance
profile	string		AWS profile
access_key	string		AWS Access Key
secret_key	string		AWS Secret Key
session_token	string		AWS Session Token

Attack command

Import-Module "PathToAtomicsFolder/T1648/src/T1648-1/LambdaAttack.ps1" -Force
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$region = "#{region}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
Invoke-Terraform -TerraformCommand init -TerraformDirectory "PathToAtomicsFolder/T1648/src/T1648-1"
Invoke-Terraform -TerraformCommand apply -TerraformDirectory "PathToAtomicsFolder/T1648/src/T1648-1" -TerraformVariables @("profile=T1648-1", "region=$region")
Invoke-LambdaAttack -AWSProfile "T1648-1" -AWSRegion $region

Cleanup command

Import-Module "PathToAtomicsFolder/T1648/src/T1648-1/LambdaAttack.ps1" -Force
$access_key = "#{access_key}"
$secret_key = "#{secret_key}"
$session_token = "#{session_token}"
$aws_profile = "#{profile}"
$region = "#{region}"
Set-AWSAuthentication -AccessKey $access_key -SecretKey $secret_key -SessionToken $session_token -AWSProfile $aws_profile -AWSRegion $region
Invoke-Terraform -TerraformCommand destroy -TerraformDirectory "PathToAtomicsFolder/T1648/src/T1648-1" -TerraformVariables @("profile=T1648-1", "region=$region")
Remove-MaliciousUser -AWSProfile "T1648-1"
Remove-TFFiles -Path "PathToAtomicsFolder/T1648/src/T1648-1/"

Prerequisite

The AWS PowerShell module must be installed.

Check

try {if (Get-InstalledModule -Name AWSPowerShell -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name AWSPowerShell -Force

Prerequisite

Terraform must be installed.

Check

terraform --version

Satisfy

Write-Host "Terraform is required. Download it from https://www.terraform.io/downloads.html"

GUIDd508ff57-3e38-4fdf-8673-46afd53fc11c

Tests from Atomic Red Team (MIT licence) · technique definition

Serverless Execution detections T1648

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs