# Blog: Preventing attacker persistence with Falco on AWS

DevFeed: [Blog: Preventing attacker persistence with Falco on AWS](<https://devfeed.tech/articles/blog-preventing-attacker-persistence-with-falco-on-aws-32476.md>)

Original publisher: [Read original article](<https://falco.org/blog/aws-detection/>)

Published: 2024-03-11T00:00:00Z

Content type: tutorial

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [AWS CloudTrail](<https://devfeed.tech/topics/aws-cloudtrail.md>), [AWS Lambda](<https://devfeed.tech/topics/aws-lambda.md>), [Persistence](<https://devfeed.tech/topics/persistence.md>), [Code](<https://devfeed.tech/topics/code.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [aws-cloudtrail](<https://devfeed.tech/tags/aws-cloudtrail.md>), [aws-lambda](<https://devfeed.tech/tags/aws-lambda.md>), [falco](<https://devfeed.tech/tags/falco.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [ip](<https://devfeed.tech/tags/ip.md>), [lambda](<https://devfeed.tech/tags/lambda.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [request](<https://devfeed.tech/tags/request.md>), [s3](<https://devfeed.tech/tags/s3.md>), [security-concept](<https://devfeed.tech/tags/security-concept.md>)

## AI overview

This article explains how an attacker could modify an existing Lex-based AWS Lambda function to disclose AWS credentials when triggered by a secret phrase. It describes using Falco's AWS CloudTrail plugin and rules to detect Lambda code updates and alert engineers for investigation.

## Source excerpt

I recently read an interesting blog on how hackers could use a Lambda function alongside Lex to establish persistence in an AWS account. For those unfamiliar with the term, persistence is when attackers leverage some technique to retain access to systems without being detected. A recent news article cited a study that reported that some Chinese hackers have lurked in systems for up to FIVE YEARS! Luckily for all of us, Falco can be used to detect the exact scenario detailed in the blog and immediately raise an alert. The blog detailed how an attacker who has gained access to an AWS account could modify an existing Lex-based Lambda function to provide a set of AWS credentials. In short, the attacker modified the function of the Lex-based chatbot to respond whenever a secret phrase was entered with the Lambda's AWS key ID and secret key. The author notes there are several ways to establish persistence on AWS, and maybe this wasn't the most practical, but I still found it a fun exercise. It got me thinking: How could Falco help here? My immediate thought was to use Falco's AWS Cloudtrail plugin. The plugin, as the name implies, ingests Cloudtrail events. The events can be evaluated against a set of rules to alert engineers of any suspicious activity. There are currently just over 20 different rules that can be assessed. They include scenarios like creating new users, having someone log into the root account without MFA, changing permissions on an S3 bucket, and, most relevant to our discussion here, modifying a Lambda function. - rule: Update Lambda Function Code desc: Detect updates to a Lambda function code. condition: ct.name="UpdateFunctionCode20150331v2" and not ct.error exists output: The code of a Lambda function has been updated. (requesting user=%ct.user, requesting IP=%ct.srcip, AWS region=%ct.region, lambda function=%ct.request.functionname) priority: WARNING tags: - cloud - MITRE_TA0003_persistence - aws_lambda source: aws_cloudtrail Alternatively, you coul