domains / families / security / detecting-serverless-function-injection

detecting-serverless-function-injection

separate

'Detects and prevents code injection attacks targeting serverless functions

When to use

• Auditing Lambda/Cloud Functions for code injection vulnerabilities where unsanitized event data flows into dangerous runtime functions (`eval`, `exec`, `child_process.exec`, `os.system`)
• Investigating incidents where an attacker modified function code or layers to establish persistence or exfiltrate data from the serverless environment
• Detecting privilege escalation paths where an adversary with `lambda:UpdateFunctionCode` and `iam:PassRole` can assume higher-privilege execution roles
• Analyzing event source poisoning attacks where malicious payloads are injected through S3 object uploads, SQS messages, DynamoDB stream records, or API Gateway requests that trigger function execution
• Building detection rules for SOC teams monitoring serverless workloads for unauthorized function modifications, layer additions, and suspicious invocation patterns

When not to use

• Load testing or denial-of-service simulation against serverless functions
• Testing against production functions processing live customer data without explicit authorization
• Modifying IAM policies in shared accounts without change management approval

Skill page

Source