Now, creating our persistent backdoors in an account is extremely useful, but what if even those get detected and removed from the environment? We can use AWS Lambda as a watchdog to monitor activity in the account and to run commands in response to certain events, allowing us to react to a defender's actions.
Basically, AWS Lambda is how you run serverless code in AWS. In simple terms, you upload your code (whether that is Node.js, Python, or whatever) and set up a trigger for your function so that, when that trigger is hit, your code executes in the cloud and does something with the incoming data.
We attackers can use this to our advantage in many ways. We can use it to alert on activity in the account:
- The activity may help us to exploit the account
- It might mean we have been detected by a defender
There are many more things...