Attacker Serverless Infrastructure: T1583.007 Explained

Acquire Infrastructure: Serverless (T1583.007) is a resource development technique with the PRE platform tag.

The adversary purchases and configures serverless cloud infrastructure for use against a target.

How attackers use it

MITRE gives Cloudflare Workers, AWS Lambda functions and Google Apps Scripts as examples. Serverless hosting makes it harder to attribute infrastructure back to the adversary.

Once set up, the runtime can answer infected machines directly or proxy traffic to a command and control server owned by the adversary. Because the traffic comes from subdomains of common cloud providers, it can be hard to tell from ordinary traffic to those providers. MITRE connects this to hiding infrastructure.

How to detect it

MITRE says to look for unique characteristics of adversary software if they are known, for example an implant that always uses a recognizable request pattern when it contacts a function URL. It also says much of the activity is outside the visibility of the target organization, so detection efforts should focus on related stages of the lifecycle.

A reasonable starting point is DNS and proxy telemetry. Rare, newly seen subdomains of large cloud providers, contacted by only one or two hosts, deserve a second look. This is a general approach, not a MITRE analytic.

How to reduce the risk

MITRE's mitigation is Pre-compromise: no easy preventive control exists, because the behavior happens outside enterprise defenses.

General practice that still helps:

• Treat traffic to shared cloud domains as untrusted by default for servers and sensitive workloads, and allow only the specific hostnames they need.
• Log DNS queries and proxy requests with the full hostname, not only the parent domain.

Quick check

Sources

• MITRE ATT&CK T1583.007: Serverless