CreateFunctionUrlConfig

[saakovv]

Summary of the Pull Request

This rule now tracks the creation of the Lambda function URL configuration, which can be used by attackers to gain unauthorized access to Lambda functions and their privileges.

Changelog

Example Log Event

{ [-]
   awsCloud_account_ID: XXX
   awsRegion: eu-central
   cwlGroupname: aws-controltower/CloudTrailLogs
   eventCategory: Management
   eventID: 6e683fe2
   eventName: CreateFunctionUrlConfig
   eventSource: lambda.amazonaws.com
   eventTime: 2024-09-12T08:50:11Z
   eventType: AwsApiCall
   eventVersion: 1.08
   managementEvent: true
   readOnly: false
   recipientAccountId: XXX
   requestID: db215d0a
   requestParameters: { [-]
     authType: NONE
     cors: { [-]
     }
     functionName: XXX
     invokeMode: BUFFERED
   }
   responseElements: { [-]
     authType: NONE
     creationTime: 2024-09-12T08:50:11.556353Z
     functionArn: arn:aws:lambda:eu-central-XXX:function:XXX
     functionUrl: https://XXX
     invokeMode: BUFFERED
   }
   sessionCredentialFromConsole: true
   sourceIPAddress: XXX
   tlsDetails: { [-]
     cipherSuite: TLS_AES_128_GCM_SHA256
     clientProvidedHostHeader: lambda.eu-central.amazonaws.com
     tlsVersion: TLSv1.3
   }
   userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
   userIdentity: { [-]
     accessKeyId: XXX
     accountId: XXX
     arn: arn:aws:iam::XXX:user/XXX
     principalId: XXX
     sessionContext: { [-]
       attributes: { [-]
         creationDate: 2024-09-12T08:46:54Z
         mfaAuthenticated: false
       }
       sessionIssuer: { [-]
       }
       webIdFederationData: { [-]
       }
     }
     type: IAMUser
     userName: XXX
   }
}

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

LGTM

[saakovv]

added references