2026 Critical Cloud Control Plane Detection: Serverless Function Deployment with Elevated Role and Outbound C2-Like Network Behavior
Detects the creation of an AWS Lambda function that is assigned an excessively privileged execution role (e.g., AdministratorAccess). Attackers often leverage this technique to establish persistence or facilitate privilege escalation by creating backdoored functions that run with broad administrative permissions.
Sigma
