AWS New Lambda Layer Attached

SigmaHQ Detections@sigmaHQ

•updated Apr 7, 2025•0•0•1

Detects when a user attached a Lambda layer to an existing Lambda function. A malicious Lambda layer could execute arbitrary code in the context of the function's IAM role. This would give an adversary access to resources that the function has access to.