Vendors / Amazon Web Services / AWS GuardDuty / GuardDuty Lambda Protection Finding Types

Event type

GuardDuty Lambda Protection Finding Types

Threat detection for AWS Lambda functions

AWS GuardDuty Lambda Protection finding types detecting threats against AWS Lambda functions through network activity monitoring, including command and control communications, cryptocurrency mining, trojan activity, malicious IP access, and Tor network usage

JSON 18 fields Medium Generator

lambda serverless function network-activity threat-detection

Preview Sample View Schema

CLI Install

meltr templates install aws

Overview

What this event covers

Lambda Protection monitors network activity from AWS Lambda functions to detect malicious behavior including command and control communications, cryptocurrency mining, trojan activity, malicious IP access, and Tor network usage. Uses threat intelligence and network pattern analysis to identify suspicious Lambda function behavior.

When generated

›Lambda function queries IP address associated with known command and control server
›Lambda function queries IP address associated with cryptocurrency-related activity
›Lambda function exhibits blackhole traffic pattern
›Lambda function exhibits drop point trojan activity
›Lambda function makes connections to known malicious IP address (custom threat list)
›Lambda function makes connections to Tor Guard or Authority node
›Lambda function acts as Tor relay

Security relevance

High

Compliance

PCI-DSS 11.4 HIPAA 164.312(b) SOC 2 CC7.2 ISO 27001 A.12.4.1 NIST CSF PR.DS-5, DE.AE-3 CIS AWS Foundations 4.1-4.16

Frequency notes

Lambda Protection findings frequency depends on Lambda function network activity and threat landscape. Production environments typically see 5-30 findings per day. C&C and cryptocurrency findings are high-severity but lower frequency (2-15 per day). Trojan activity findings are medium-severity (5-20 per day). Malicious IP and Tor findings indicate active attacks (3-15 per day during attacks). All Lambda Protection findings have High default severity (8.0).

Resources

Docs and tools

Lambda Protection Finding Types official Remediating Potentially Compromised Lambda Function official GuardDuty Lambda Protection official Lambda Network Activity Monitoring official AWS GuardDuty Console Web interface for viewing and managing Lambda Protection findings AWS Lambda Console Manage Lambda functions and view execution logs AWS Security Hub Centralized security findings including GuardDuty Lambda findings

Generation

Configuration

Base frequency: 20 events/hour
Time patterns: business_hours night_hours weekend
Business hours: 2.0x
Night hours: 1.5x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

detail.type

String Required

Lambda Protection finding type indicating attack category and detection method

Source: random_choice() of 7 Lambda Protection finding types

Example Backdoor:Lambda/C&CActivity.B

Values

Backdoor:Lambda/C&CActivity.B Lambda function querying IP associated with known C&C server (severity: High)
CryptoCurrency:Lambda/BitcoinTool.B Lambda function querying IP associated with cryptocurrency activity (severity: High)
Trojan:Lambda/BlackholeTraffic Lambda function blackhole traffic pattern detected (severity: High)
Trojan:Lambda/DropPoint Lambda function drop point trojan activity detected (severity: High)
UnauthorizedAccess:Lambda/MaliciousIPCaller.Custom Lambda function making connections to known malicious IP (custom threat list) (severity: High)
UnauthorizedAccess:Lambda/TorClient Lambda function making connections to Tor Guard or Authority node (severity: High)
UnauthorizedAccess:Lambda/TorRelay Lambda function acting as Tor relay (severity: High)

detail.resource.resourceType

String Required

Type of resource (always Lambda for Lambda Protection findings)

Source: Fixed value: 'Lambda'

Example Lambda

Values

Lambda AWS Lambda function

detail.resource.lambdaDetails

Object Required

Details about the Lambda function where activity was detected

Source: Lambda function metadata from GuardDuty

Example {functionArn, functionName, description, runtime, handler, role, vpcConfig}

detail.resource.lambdaDetails.functionArn

String Required

Amazon Resource Name (ARN) of the Lambda function

Source: Lambda function ARN from GuardDuty

Format AWS Lambda function ARN

Example arn:aws:lambda:us-east-1:123456789012:function:api-handler

detail.resource.lambdaDetails.functionName

String Required

Name of the Lambda function

Source: Lambda function name from GuardDuty

Format Lambda function name

Example api-handler

detail.resource.lambdaDetails.runtime

String Required

Runtime environment for the Lambda function

Source: random_choice() of Lambda runtime environments

Format Lambda runtime identifier

Example python3.11

Values

python3.11 Python 3.11
python3.12 Python 3.12
nodejs20.x Node.js 20.x
nodejs18.x Node.js 18.x
java17 Java 17
java21 Java 21
go1.x Go 1.x
ruby3.2 Ruby 3.2
dotnet8 .NET 8

detail.resource.lambdaDetails.handler

String Required

Lambda function handler (entry point)

Source: random_choice() of common Lambda handlers

Format Handler identifier

Example index.handler

detail.resource.lambdaDetails.role

String Required

IAM role ARN used by the Lambda function

Source: Lambda execution role ARN

Format IAM role ARN

Example arn:aws:iam::123456789012:role/lambda-execution-role

detail.resource.lambdaDetails.vpcConfig

Object Optional

VPC configuration for Lambda function (if function is in VPC)

Source: VPC configuration from Lambda function metadata

Example {vpcId, subnetIds, securityGroupIds}

detail.service.action.actionType

String Required

Type of action that triggered the finding

Source: random_choice(['NETWORK_CONNECTION', 'DNS_REQUEST'])

Example NETWORK_CONNECTION

Values

NETWORK_CONNECTION Network connection from Lambda function
DNS_REQUEST DNS query from Lambda function

detail.service.action.networkConnectionAction.connectionDirection

String Required

Direction of network connection (usually OUTBOUND for Lambda)

Source: random_choice(['OUTBOUND', 'INBOUND'])

Example OUTBOUND

Values

OUTBOUND Lambda function initiated connection to remote host
INBOUND Remote host initiated connection to Lambda function (rare)

detail.service.action.networkConnectionAction.remoteIpDetails.ipAddressV4

String Required

Remote IP address that Lambda function connected to

Source: random_public_ip()

Format IPv4 address

Example 203.0.113.42

detail.service.action.networkConnectionAction.remotePortDetails.port

Integer Required

Remote port number that Lambda function connected to

Source: random_choice() of common service ports

Format Integer (1-65535)

Example 443

Values

80 HTTP
443 HTTPS
8333 Bitcoin P2P
8332 Bitcoin RPC
4444 Common backdoor port
8080 HTTP alternate

detail.service.action.networkConnectionAction.protocol

String Required

Network protocol used

Source: random_choice(['TCP', 'UDP'])

Example TCP

Values

TCP Transmission Control Protocol
UDP User Datagram Protocol

detail.service.action.dnsRequestAction.domain

String Optional

Domain name queried by Lambda function (for DNS-based findings)

Source: random_choice() of test and malicious domains

Format Domain name

Example guarddutyc2activityb.com

detail.service.additionalInfo.threatListName

String Optional

Name of threat intelligence list that matched

Source: random_choice() of threat intelligence list names

Format Threat list name

Example ProofPoint

Values

ProofPoint ProofPoint threat intelligence feed
Custom Threat List Custom user-defined threat list (for MaliciousIPCaller.Custom)
AWS Threat Intelligence AWS managed threat intelligence
Tor Exit Nodes Tor exit node list
Amazon Amazon threat intelligence (includes Log4j-related threats)

detail.service.additionalInfo.threatName

String Optional

Name of the specific threat identified

Source: random_choice() of threat names

Format Threat name

Example C&C Server

Values

C&C Server Command and control server
Bitcoin Mining Cryptocurrency mining activity
Tor Network Tor network node
Log4j Related Log4j vulnerability exploitation
Malicious Domain Known malicious domain

detail.severity

Integer Required

Finding severity level (all Lambda Protection findings have High default severity)

Source: random_choice([8, 8, 8]) - default is High

Example 8

Values

8 High severity (7.0-8.9) - default for all Lambda Protection findings