Rule tuning: AWS Attached Malicious Lambda Layer should be informational/low and renamed

[nickatrecon]

Rule UUID

97fbabf8-8e1b-47a2-b7d5-a418d2b95e3d

Example EventLog

N/A

Description

The rule alerts on calls to UpdateFunctionConfiguration, which does not imply maliciousness as the title suggests. This happens every time an authenticated user creates a new Lambda layer, which is a relatively common occurrence for developers in AWS. The rule lists this scenario as a false positive, but it is the significantly more common scenario than the perceived threat and results in significant noise during development. This rule should be named AWS New Lambda Layer Attached and the level be set to informational or low.

Based on my research this threat is limited to a proof of concept. This could be added as a reference.

[github-actions]

Welcome @nickatrecon 👋

It looks like this is your first issue on the Sigma rules repository!

The following repository accepts issues related to false positives or 'rule ideas'.

If you're reporting an issue related to the pySigma library please consider submitting it here

If you're reporting an issue related to the deprecated sigmac library please consider submitting it here

Thanks for taking the time to open this issue, and welcome to the Sigma community! 😃