Sigma rule: AWS New Lambda Layer Attached

Rule

Title

AWS New Lambda Layer Attached

Status

test

Level

low

Author

Austin Songer

Date

2021-09-23

Modified

2025-03-17

File

rules/cloud/aws/cloudtrail/aws_new_lambda_layer_attached.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a user attached a Lambda layer to an existing Lambda function.
A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role.
This would give an adversary access to resources that the function has access to.

Log source

product

aws

service

cloudtrail

Detection

selection:
    eventSource: lambda.amazonaws.com
    eventName|startswith: 'UpdateFunctionConfiguration'
    requestParameters.layers|contains: '*'
condition: selection

False positives (as the rule lists them)

• Lambda Layer being attached may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
• Lambda Layer being attached from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.privilege-escalation

References

• https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html
• https://github.com/clearvector/lambda-spy

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/aws/cloudtrail/aws_new_lambda_layer_attached.yml