Compromise Infrastructure: Serverless (T1584.007) is a resource development technique with the PRE platform tag. The adversary compromises serverless infrastructure that someone else runs.
How attackers use it
MITRE gives Cloudflare Workers, AWS Lambda functions and Google Apps Scripts as examples. Serverless infrastructure makes it harder to attribute operations to the adversary.
After compromise, the runtime can answer infected machines directly or proxy traffic to a command and control server. Traffic from these functions appears to come from subdomains of common cloud providers, so it is hard to tell from ordinary traffic to those providers.
If it is your function, you may never see the traffic. It runs on your account and under your bill.
How to detect it
MITRE says to look for unique characteristics of adversary software, if known, and notes that most of the activity is outside the visibility of the target organization.
As the owner of functions, you do have visibility that outsiders lack:
- Review function code and configuration changes in the audit log of your cloud account.
- Watch invocation counts, error rates and outbound destinations for functions that suddenly change.
- Alert on new functions, triggers or public function URLs that nobody on your team created.
Click through it at your own pace, or open it full screen.
How to reduce the risk
MITRE's mitigation is Pre-compromise. The preventive work is on the owner side, and this is general practice.
- Protect cloud console and API credentials with strong authentication and least privilege.
- Remove functions and triggers you no longer use.
- Restrict who may deploy or change functions, and log it.
- Scan function dependencies for known vulnerabilities and for packages you did not intend to include.
Quick check
Why can a compromised function hide traffic well?
Its traffic appears to come from subdomains of common cloud providers, which look like ordinary traffic to those providers.
What can the function owner see that outsiders cannot?
Audit logs, configuration changes, invocation counts and outbound destinations in their own cloud account.
