ATT&CK technique
View on MITRE ATT&CK →
T1648
Serverless Execution
Execution
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | AWS Lambda Function Invoked by an Unusual Principal | production | 2026-09-28 |
| elastic | AWS Lambda Function Invoked Cross-Account | production | 2026-09-18 |
| elastic | AWS Lambda Function Invoked from an Unusual Source ASN | production | 2026-09-18 |
| elastic | AWS Lambda Layer Shared Externally | production | 2026-09-18 |
| elastic | First Time AWS CloudFormation Stack Creation | production | 2026-09-18 |
| elastic | AWS Lambda Layer Added to Existing Function | production | 2026-09-18 |
| elastic | Azure Automation Runbook Created or Modified | production | 2026-09-18 |
| elastic | GitHub App Deleted | production | 2026-09-18 |
| elastic | High Number of Cloned GitHub Repos From PAT | production | 2026-09-18 |
| elastic | AWS Lambda Event Source Mapping Creation | production | 2026-09-18 |