Skip to content

[Rule Tunings] AWS Lambda Rules #5451

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
imays11 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

[Rule Tunings] AWS Lambda Rules #5451

imays11 wants to merge 2 commits into from
+160 −69

Conversation

@imays11
Copy link
Contributor

@imays11 imays11 commented Dec 11, 2025

Pull Request

Issue link(s):

Summary - What I changed

AWS Lambda Layer Added to Existing Function

This rule was missing alerts for the UpdateFunctionConfiguration action due to a missing wildcard.

  • added missing wildcard to query
  • reduced execution window
  • updated description, FP and IG sections
  • added highlighted fields
missing vs included UpdateFunctionConfiguration actions
Screenshot 2025-12-11 at 3 09 38 PM Screenshot 2025-12-11 at 3 09 49 PM

Expected Alert for PublishLayerVersion* action

Screenshot 2025-12-11 at 1 32 35 PM

AWS Lambda Function Policy Updated to Allow Public Invocation

  • changed this query to use EQL instead of KQL to optimize wildcard usage
  • uses event.type as event_category_override
  • reduced execution window
  • updated description, FP and IG sections
  • added highlighted fields
Working EQL query
Screenshot 2025-12-11 at 4 21 14 PM
Expected Alert
Screenshot 2025-12-11 at 1 31 26 PM

How To Test

Plenty of data in our stack for running query against
Set of scripts for testing : Lambda

@imays11
[Rule Tunings] AWS Lambda Rules
731c23f 
#### AWS Lambda Layer Added to Existing Function
This rule was missing alerts for the `UpdateFunctionConfiguration` action due to a missing wildcard.
- added missing wildcard to query
- reduced execution window
- updated description, FP and IG sections
- added highlighted fields

#### AWS Lambda Function Policy Updated to Allow Public Invocation
- changed this query to use EQL instead of KQL to optimize wildcard usage
- uses `event.type` as `event_category_override`
- reduced execution window
- updated description, FP and IG sections
- added highlighted fields
@imays11 imays11 self-assigned this Dec 11, 2025
@imays11 imays11 added Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE Domain: Cloud labels Dec 11, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Dec 11, 2025

Rule: Tuning - Guidelines

These guidelines serve as a reminder set of considerations when tuning an existing rule.

Documentation and Context

  • Detailed description of the suggested changes.
  • Provide example JSON data or screenshots.
  • Provide evidence of reducing benign events mistakenly identified as threats (False Positives).
  • Provide evidence of enhancing detection of true threats that were previously missed (False Negatives).
  • Provide evidence of optimizing resource consumption and execution time of detection rules (Performance).
  • Provide evidence of specific environment factors influencing customized rule tuning (Contextual Tuning).
  • Provide evidence of improvements made by modifying sensitivity by changing alert triggering thresholds (Threshold Adjustments).
  • Provide evidence of refining rules to better detect deviations from typical behavior (Behavioral Tuning).
  • Provide evidence of improvements of adjusting rules based on time-based patterns (Temporal Tuning).
  • Provide reasoning of adjusting priority or severity levels of alerts (Severity Tuning).
  • Provide evidence of improving quality integrity of our data used by detection rules (Data Quality).
  • Ensure the tuning includes necessary updates to the release documentation and versioning.

Rule Metadata Checks

  • updated_date matches the date of tuning PR merged.
  • min_stack_version should support the widest stack versions.
  • name and description should be descriptive and not include typos.
  • query should be inclusive, not overly exclusive. Review to ensure the original intent of the rule is maintained.

Testing and Validation

  • Validate that the tuned rule's performance is satisfactory and does not negatively impact the stack.
  • Ensure that the tuned rule has a low false positive rate.

Samirbous
Samirbous reviewed Dec 12, 2025
View reviewed changes
rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml
and event.outcome == "success"
and event.action : "AddPermission*"
and stringContains(aws.cloudtrail.request_parameters, "lambda:InvokeFunction")
and stringContains(aws.cloudtrail.request_parameters, "principal=\\*")
Copy link
Contributor

@Samirbous Samirbous Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

was this tested in match on princioal=* ?

Copy link
Contributor Author

@imays11 imays11 Dec 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes I tested to capture that, I have the screenshot of the working query in the issue description. If you run it in our test stack it'll capture that event from yesterday.

Mikaayenson
Mikaayenson approved these changes Dec 18, 2025
View reviewed changes
Copy link
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Small typo, otherwise lgtm

@imays11 @Mikaayenson
Update rules/integrations/aws/persistence_lambda_backdoor_invoke_func…
cae2324 
…tion_for_any_principal.toml

Co-authored-by: Mika Ayenson, PhD <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Samirbous Samirbous Samirbous left review comments

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@w0rk3r w0rk3r Awaiting requested review from w0rk3r

@Aegrah Aegrah Awaiting requested review from Aegrah

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

Assignees

@imays11 imays11

Labels

backport: auto Domain: Cloud Integration: AWS AWS related rules Rule: Tuning tweaking or tuning an existing rule Team: TRADE

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@imays11 @Mikaayenson @Samirbous @terrancedejesus