Sigma rule: New AWS Lambda Function URL Configuration Created

Rule

Title

New AWS Lambda Function URL Configuration Created

Status

experimental

Level

medium

Author

Ivan Saakov

Date

2024-12-19

File

rules/cloud/aws/cloudtrail/aws_lambda_function_url.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when a user creates a Lambda function URL configuration, which could be used to expose the function to the internet and potentially allow unauthorized access to the function's IAM role for AWS API calls.
This could give an adversary access to the privileges associated with the Lambda service role that is attached to that function.

Log source

product

aws

service

cloudtrail

Detection

selection:
    eventSource: lambda.amazonaws.com
    eventName: 'CreateFunctionUrlConfig'
condition: selection

False positives (as the rule lists them)

• Creating a Lambda function URL configuration may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
• Creating a Lambda function URL configuration from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.initial-access
• attack.privilege-escalation

References

• https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
• https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
• https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/aws/cloudtrail/aws_lambda_function_url.yml