{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1648","id":"T1648","name":"Serverless Execution","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1648","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"0165a809dee9157f71a8e3ab437517aaa269a50fe9426f13265544f4da281b34","description":"Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers. \n\nAdversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. [Resource Hijacking](https://attack.mitre.org/techniques/T1496)).(Citation: Cado Security Denonia) Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the `IAM:PassRole` permission in AWS or the `iam.serviceAccounts.actAs` permission in Google Cloud to add [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) to a serverless cloud function, which may then be able to perform actions the original user cannot.(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Rhingo Security Labs GCP Privilege Escalation)\n\nServerless functions can also be invoked in response to cloud events (i.e. [Event Triggered Execution](https://attack.mitre.org/techniques/T1546)), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created.(Citation: Backdooring an AWS account) This is also possible in many cloud-based office application suites. For example, in Microsoft 365 environments, an adversary may create a Power Automate workflow that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint.(Citation: Varonis Power Automate Data Exfiltration)(Citation: Microsoft DART Case Report 001) In Google Workspace environments, they may instead create an Apps Script that exfiltrates a user's data when they open a file.(Citation: Cloud Hack Tricks GWS Apps Script)(Citation: OWN-CERT Google App Script 2024)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1648","external_id":"T1648"},{"source_name":"Microsoft DART Case Report 001","description":"Berk Veral. (2020, March 9). Real-life cybercrime stories from DART, the Microsoft Detection and Response Team. Retrieved May 27, 2022.","url":"https://www.microsoft.com/security/blog/2020/03/09/real-life-cybercrime-stories-dart-microsoft-detection-and-response-team"},{"source_name":"Backdooring an AWS account","description":"Daniel Grzelak. (2016, July 9). Backdooring an AWS account. Retrieved May 27, 2022.","url":"https://medium.com/daniel-grzelak/backdooring-an-aws-account-da007d36f8f9"},{"source_name":"Varonis Power Automate Data Exfiltration","description":"Eric Saraga. (2022, February 2). Using Power Automate for Covert Data Exfiltration in Microsoft 365. Retrieved May 27, 2022.","url":"https://www.varonis.com/blog/power-automate-data-exfiltration"},{"source_name":"Cloud Hack Tricks GWS Apps Script","description":"HackTricks Cloud. (n.d.). GWS - App Scripts. Retrieved July 1, 2024.","url":"https://cloud.hacktricks.xyz/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts"},{"source_name":"OWN-CERT Google App Script 2024","description":"L'Hutereau Arnaud. (n.d.). Google Workspace Malicious App Script analysis. Retrieved October 2, 2024.","url":"https://www.own.security/ressources/blog/google-workspace-malicious-app-script-analysis"},{"source_name":"Cado Security Denonia","description":"Matt Muir. (2022, April 6). Cado Discovers Denonia: The First Malware Specifically Targeting Lambda. Retrieved May 27, 2022.","url":"https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/"},{"source_name":"Rhino Security Labs AWS Privilege Escalation","description":"Rhino Security Labs. (n.d.). AWS IAM Privilege Escalation – Methods and Mitigation. Retrieved May 27, 2022.","url":"https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"},{"source_name":"Rhingo Security Labs GCP Privilege Escalation","description":"Spencer Gietzen. (n.d.). Privilege Escalation in Google Cloud Platform – Part 1 (IAM). Retrieved May 27, 2022.","url":"https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/"}],"platforms":["SaaS","IaaS","Office Suite"],"environments":["cloud","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0069","name":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component","category":"Cloud control plane","description":"Changes to a managed cloud service configuration.","collection_focus":"Collect the service-specific update API and resulting configuration state; record account/project, actor and changed settings.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["service","resource_id","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."}],"detection":{"key":"enterprise/T1648","id":"T1648","name":"Serverless Execution","domain":"enterprise","platforms":["SaaS","IaaS","Office Suite"],"environments":["cloud","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1648","technique_page":"techniques/enterprise/T1648/","page":"detections/enterprise/T1648/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[{"id":"atlas-anomaly-t1648-1","technique_id":"T1648","title":"Unexpected serverless or cloud-workload invocation — T1648 Serverless Execution","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#serverless-execution","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":48,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L48","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"a56a14b7b50bd71a6a78ab6877dc9d3936bc38dbad4f91e50d7834ee2b36456a","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"function, caller, and trigger.","expected_behavior":"functions are invoked by known trigger and caller combinations with stable rates.","deviation":"new caller-trigger edge, burst, or invocation outside established temporal context.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Temporal-Context Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#21-temporal-context-anomaly"}],"log_sources":[{"title":"Cloud Function and Serverless Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#110-cloud-function-and-serverless-logs"},{"title":"Cloud Control-Plane Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#103-cloud-control-plane-audit-logs"}],"context_references":[{"title":"Sysdig AI-assisted cloud intrusion investigation — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/sysdig-ai-assisted-cloud-intrusion.html"},{"title":"original source","url":"https://www.sysdig.com/blog/ai-assisted-cloud-intrusion-achieves-admin-access-in-8-minutes"}]}],"anomaly_types":[{"title":"Burst Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#16-burst-anomaly"},{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Temporal-Context Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#21-temporal-context-anomaly"}],"strategies":[{"id":"DET0374","name":"Detection Strategy for Serverless Execution (T1648)","url":"https://attack.mitre.org/detectionstrategies/DET0374","stix_id":"x-mitre-detection-strategy--7a848f8f-4bdc-426c-989e-bc1abfaeb7fa","relationship_id":"relationship--e6c1e0f5-7426-4670-9f3e-7479a4b2ba20","description":"","analytics":[{"id":"AN1053","name":"Analytic 1053","guidance":"Correlate creation or modification of serverless functions (e.g., AWS Lambda, GCP Cloud Functions, Azure Functions) with anomalous IAM role assignments or permissions escalation events. Detect subsequent executions of newly created functions that perform unexpected actions such as spawning outbound network connections, accessing sensitive resources, or creating additional credentials.","url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1053","platforms":["IaaS"],"tuning":[{"field":"RoleScope","description":"Which IAM roles or privileges are considered sensitive when applied to functions"},{"field":"AllowedFunctions","description":"Known baseline list of approved serverless functions to reduce false positives"},{"field":"TimeWindow","description":"Temporal threshold for correlating function creation with anomalous execution"}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"AWS:CloudTrail","channel":"CreateFunction / UpdateFunctionConfiguration: Function creation, role assignment, or configuration change events","platforms":["IaaS"],"analytic_id":"AN1053","source_url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1053","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"},{"component_id":"DC0038","component":"Application Log Content","name":"AWS:CloudTrail","channel":"InvokeFunction: Unexpected or repeated invocation of functions not tied to known workflows","platforms":["IaaS"],"analytic_id":"AN1053","source_url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1053","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1054","name":"Analytic 1054","guidance":"Monitor for creation of new Power Automate flows or equivalent automation scripts that trigger on user or file events. Detect anomalous actions performed by these automations, such as email forwarding, anonymous link creation, or unexpected API calls to external endpoints.","url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1054","platforms":["Office Suite"],"tuning":[{"field":"UserContext","description":"Business units or users where automation creation is expected (developers, admins)"},{"field":"FlowActions","description":"Specific automation actions (email forwarding, file sharing) that should be considered suspicious"}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"m365:unified","channel":"AddFlow / UpdateFlow: New automation or workflow creation events","platforms":["Office Suite"],"analytic_id":"AN1054","source_url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1054","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"},{"component_id":"DC0038","component":"Application Log Content","name":"m365:exchange","channel":"New-InboxRule: Automation that triggers abnormal forwarding or external link generation","platforms":["Office Suite"],"analytic_id":"AN1054","source_url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1054","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1055","name":"Analytic 1055","guidance":"Track creation or update of SaaS automation scripts (e.g., Google Workspace Apps Script). Detect when these scripts are bound to user events such as file opens or account modifications, and correlate with subsequent abnormal API calls that exfiltrate or modify user data.","url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1055","platforms":["SaaS"],"tuning":[{"field":"ScriptScope","description":"Which SaaS apps or APIs can be legitimately automated in the environment"},{"field":"TriggerTypes","description":"Event-driven triggers (e.g., on file open, on user creation) considered suspicious"}],"log_sources":[{"component_id":"DC0069","component":"Cloud Service Modification","name":"saas:appsscript","channel":"Create / Update: Deployment of scripts with event-driven triggers","platforms":["SaaS"],"analytic_id":"AN1055","source_url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1055","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0069/"},{"component_id":"DC0038","component":"Application Log Content","name":"saas:googledrive","channel":"FileOpen / FileAccess: Event-driven script triggering on user file actions","platforms":["SaaS"],"analytic_id":"AN1055","source_url":"https://attack.mitre.org/detectionstrategies/DET0374#AN1055","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0069","name":"Cloud Service Modification","tag":"Cloud Service Modification","page":"telemetry/DC0069/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1091","name":"Pacu","page":"tools/S1091/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S1091","name":"Pacu","url":"https://attack.mitre.org/software/S1091","kind":"tool","description":"[Pacu](https://attack.mitre.org/software/S1091) can create malicious Lambda functions.(Citation: GitHub Pacu)","relationship_id":"relationship--04f8f862-049b-40d6-8250-68ed30cd4e92","references":[{"source_name":"GitHub Pacu","description":"Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.","url":"https://github.com/RhinoSecurityLabs/pacu"}]}],"actors":[],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Remove permissions to create, modify, or run serverless resources from users that do not explicitly require them.","relationship_id":"relationship--cb2630a2-95a0-4ae8-a715-76899023d1b7","references":[]},{"id":"M1036","name":"Account Use Policies","url":"https://attack.mitre.org/mitigations/M1036","kind":"course-of-action","description":"Where possible, consider restricting access to and use of serverless functions. For examples, conditional access policies can be applied to users attempting to create workflows in Microsoft Power Automate. Google Apps Scripts that use OAuth can be limited by restricting access to high-risk OAuth scopes.(Citation: Microsoft Developer Support Power Apps Conditional Access)(Citation: Google Workspace Apps Script Restrict OAuth Scopes)","relationship_id":"relationship--1790e922-4472-4509-8193-63ba613ce068","references":[{"source_name":"Google Workspace Apps Script Restrict OAuth Scopes","description":"Google Workspace. (2024, March 5). Monitor & restrict data access. Retrieved July 1, 2024.","url":"https://developers.google.com/apps-script/guides/admin/monitor-restrict-oauth-scopes"},{"source_name":"Microsoft Developer Support Power Apps Conditional Access","description":"Microsoft Developer Support. (2020, May 9). Control Access to Power Apps and Power Automate with Azure AD Conditional Access Policies. Retrieved July 1, 2024.","url":"https://devblogs.microsoft.com/premier-developer/control-access-to-power-apps-and-power-automate-with-azure-ad-conditional-access-policies/"}]}],"candidates":[{"id":"87a4a141-c2bb-49d1-a604-8679082d8b91","name":"Lambda Function Hijack","platforms":["iaas:aws"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1648/T1648.yaml","description":"Modify an existing Lambda function to execute arbitrary code.\n","inputs":{"access_key":{"description":"AWS Access Key","type":"string","default":""},"secret_key":{"description":"AWS Secret Key","type":"string","default":""},"session_token":{"description":"AWS Session Token","type":"string","default":""},"profile":{"description":"AWS profile","type":"string","default":""},"region":{"description":"AWS region to deploy the EC2 instance","type":"string","default":"us-east-2"}},"dependencies":[{"description":"The AWS PowerShell module must be installed.\n"},{"description":"Terraform must be installed.\n"}],"source_definition_sha256":"5ba58c0680f87c6669440d07619f7da6996dc578c3883dbc6236ad2371f933ba"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1496":"/ttp-simulation/techniques/enterprise/T1496/","T1098.003":"/ttp-simulation/techniques/enterprise/T1098.003/","T1546":"/ttp-simulation/techniques/enterprise/T1546/","T1098.001":"/ttp-simulation/techniques/enterprise/T1098.001/","T1648":"/ttp-simulation/techniques/enterprise/T1648/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1648","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0069","collector":"illustrative-lab-collector","observation":{"service":"lab-audit-service","resource_id":"lab-service-1","attribute":"retention_days","before":7,"after":30}}]}}