T1648 — Serverless Execution

Tactic: Execution · Platforms: SaaS, IaaS, Office Suite

Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers. Adversaries may abuse these…

Sigma detection rules (3)

T1648 Serverless Execution

title: T1648 Serverless Execution
id: 353187ec-e882-4c76-b9a3-e15a9e66ff23
description: 'Detection Strategy for Serverless Execution (T1648). (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: RoleScope, AllowedFunctions, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1648
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.execution
  - attack.t1648

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'lambda.amazonaws.com'
    eventName:
      - 'CreateFunction20150331'
      - 'UpdateFunctionCode20150331v2'
      - 'Invoke'

  condition: selection

falsepositives:
  - Continuous integration pipelines deploying and invoking Lambda functions as part of normal release cycles.

level: medium

T1648 Serverless Execution

title: T1648 Serverless Execution
id: 97d1b8e8-dba9-4edb-9bcf-6eb6e02755f9
description: 'Detection Strategy for Serverless Execution (T1648). (Data Component: Cloud Service Modification; baseline tier: fallback.) Tune using: ScriptScope, TriggerTypes.'
references:
  - https://attack.mitre.org/techniques/T1648
author: Shahrukh Khan
date: 2026-03-01
license: MIT
tags:
  - attack.execution
  - attack.t1648

logsource:
  product: saas
  service: appsscript

detection:
  selection:
    events.name: 'INVOKE_APPS_SCRIPT'
    events.parameters.trigger_type: 'TIME_DRIVEN'

  condition: selection

falsepositives:
  - Legitimate scheduled automation scripts built by power users for routine spreadsheet, calendar, or reporting tasks.

level: medium

T1648 Serverless Execution

title: T1648 Serverless Execution
id: 3f380909-6420-4316-a919-8c781cc826a9
description: 'Detection Strategy for Serverless Execution (T1648). (Data Component: Cloud Service Modification; baseline tier: fallback.) Tune using: UserContext, FlowActions.'
references:
  - https://attack.mitre.org/techniques/T1648
author: Shahrukh Khan
date: 2026-03-12
license: MIT
tags:
  - attack.execution
  - attack.t1648

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'AddedFlow'
      - 'PowerAppCreated'
      - 'PowerAppPublished'

  condition: selection

falsepositives:
  - Business analysts legitimately building Power Automate flows or Power Apps for approved internal workflow automation.

level: medium

Explore