AWS Lambda Function Invoked for Code Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP POST requests to AWS Lambda invocation endpoints, specifically targeting URLs matching the pattern '/lambda.[a-z0-9-]+.amazonaws.com' with the URI '/invocations'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential code execution activity via AWS Lambda.