Phishing - AWS Lambda Function URL Credential Harvesting with Pre-filled Target Email

Aamir Muhammad@Aamir

•updated yesterday•8•0•17

Detects phishing campaigns leveraging AWS Lambda Function URLs with pre-filled target email parameters used for credential harvesting. The rule correlates email delivery events, URL click events from email protection/safelinks, endpoint network connections to lambda URLs, and cloud app activity referencing these infrastructure endpoints.