Cloud Function Execution Abuse

Overview

Cloud Function Execution Abuse involves adversaries leveraging cloud-based serverless functions to execute malicious code or commands within a target environment. This technique plays a critical role in various stages of the attack lifecycle by providing attackers with a scalable, flexible execution environment that can be difficult to monitor and control. Adversaries exploit cloud function execution to evade detection, maintain persistence, and facilitate lateral movement or data exfiltration.

Attack Objective

• Gain execution capabilities within a cloud environment to control or manipulate resources
• Supports multiple stages including Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Lateral Movement, Command & Control, and Exfiltration
• Advances attacker position by enabling stealthy, on-demand code execution and abuse of trusted cloud services

How the Technique Works

Adversaries abuse legitimate cloud function platforms by deploying or invoking serverless functions to run arbitrary code. These functions can be triggered via various events or API calls, allowing attackers to execute payloads without maintaining persistent infrastructure. By exploiting misconfigurations, compromised credentials, or vulnerable deployment pipelines, attackers gain the ability to execute code remotely, often blending in with normal cloud operations.

Common Methods & Variations

• Deploying malicious or modified cloud functions within target cloud accounts
• Triggering existing functions to execute unauthorized commands or scripts
• Utilizing on-premises or cloud-native identity tokens to invoke functions
• Living-off-the-land approaches by leveraging native cloud provider tooling and APIs
• Variations across major cloud providers such as AWS Lambda, Azure Functions, and Google Cloud Functions

Indicators of Compromise (IOCs)

• Unusual creation, modification, or invocation of cloud functions outside normal operational patterns
• Logs showing anomalous API calls related to function deployment or execution
• Unexpected network traffic originating from cloud functions to external or internal endpoints
• Identity and access management (IAM) anomalies such as escalated privileges or unusual token usage

Detection Strategies

• Monitoring cloud audit logs and function invocation records for irregular activity
• Behavioral analysis to identify deviations from baseline function usage patterns
• Correlation of identity and access events with function execution to detect unauthorized use
• Network traffic inspection for suspicious outbound connections initiated by cloud functions

Mitigation & Prevention

• Implement least privilege access controls and strict IAM policies for function deployment and invocation
• Enforce multi-factor authentication and credential rotation for cloud accounts
• Enable logging and continuous monitoring of cloud function activities
• Use network segmentation and egress filtering to limit function communication
• Regularly audit and review deployed functions and associated permissions

Response Considerations

• Immediately disable or quarantine suspicious cloud functions to contain execution
• Investigate related identity and access events to determine scope of compromise
• Analyze function code and invocation context to identify attacker objectives
• Revoke or rotate compromised credentials and review IAM policies
• Harden cloud environment configurations and implement enhanced monitoring post-incident

Related Techniques

• Credential Access via Cloud Service Misconfigurations
• Abuse of Cloud Infrastructure for Lateral Movement
• Use of Legitimate Credentials for Privilege Escalation
• Data Staged or Exfiltrated via Cloud Storage Services
• Command and Control over Cloud APIs or Functions

Mapping & References

• MITRE ATT&CK: T1524 – Cloud Service Execution
• MITRE ATT&CK: T1078 – Valid Accounts
• Public advisories on cloud function abuse from cloud providers and security organizations
• Industry incident reports documenting serverless function exploitation