Serverless Execution

{
  "id": "ATTACK:enterprise:T1648",
  "title": "Serverless Execution",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1648",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e848506b-8484-4410-8017-3d235a52f5b3",
  "external_id": "T1648",
  "domain": "enterprise",
  "created": "2022-05-27T13:19:51.112Z",
  "modified": "2025-04-15T19:59:17.861Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Microsoft DART Case Report 001",
      "url": "https://www.microsoft.com/security/blog/2020/03/09/real-life-cybercrime-stories-dart-microsoft-detection-and-response-team"
    },
    {
      "source_name": "Backdooring an AWS account",
      "url": "https://medium.com/daniel-grzelak/backdooring-an-aws-account-da007d36f8f9"
    },
    {
      "source_name": "Varonis Power Automate Data Exfiltration",
      "url": "https://www.varonis.com/blog/power-automate-data-exfiltration"
    },
    {
      "source_name": "Cloud Hack Tricks GWS Apps Script",
      "url": "https://cloud.hacktricks.xyz/pentesting-cloud/workspace-security/gws-google-platforms-phishing/gws-app-scripts"
    },
    {
      "source_name": "OWN-CERT Google App Script 2024",
      "url": "https://www.own.security/ressources/blog/google-workspace-malicious-app-script-analysis"
    },
    {
      "source_name": "Cado Security Denonia",
      "url": "https://www.cadosecurity.com/cado-discovers-denonia-the-first-malware-specifically-targeting-lambda/"
    },
    {
      "source_name": "Rhino Security Labs AWS Privilege Escalation",
      "url": "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/"
    },
    {
      "source_name": "Rhingo Security Labs GCP Privilege Escalation",
      "url": "https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/"
    }
  ]
}