<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-serverless-cold-start-attacks
description: >-
  Detect and mitigate serverless cold start exploitation including function
  injection during initialization, dependency confusion in layers, runtime
  manipulation, and timing-based side-channel attacks on AWS Lambda, Azure
  Functions, and GCP Cloud Functions.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - serverless
  - lambda
  - cold-start
  - function-injection
  - cloud-functions
  - runtime-security
  - side-channel
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.009"]
---

# Detecting Serverless Cold Start Attacks

## Overview

Detect and mitigate serverless cold start exploitation including function injection during initialization, dependency confusion in layers, runtime manipulation, and timing-based side-channel attacks on AWS Lambda, Azure Functions, and GCP Cloud Functions.

Mode: `[MODE: RED]` — Cold start exploitation (T1059.009). `[MODE: BLUE]` — Detect init-phase abuse.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI / gcloud / az CLI configured | Required |
| CloudWatch, Cloud Logging, or Azure Monitor access | Required |
| Function source code access for static analysis | Required |

## Key Concepts

### Detect Suspicious Lambda Layers

```bash
# List all Lambda layers in use
aws lambda list-functions --query 'Functions[].Layers[].Arn' --output json | \
  jq -r '.[][]' | sort -u

# Check layer permissions (public layers are risky)
aws lambda get-layer-version-policy --layer-name LAYER --version-number VER
```

### Monitor Init Duration Anomalies

```bash
# CloudWatch query for abnormal init durations
aws logs filter-log-events \
  --log-group-name /aws/lambda/FUNCTION \
  --filter-pattern '"Init Duration"' \
  --query 'events[].message'
```

### Audit Function Environment Variables

```bash
# Check for sensitive data in env vars
aws lambda get-function-configuration --function-name FUNC --query 'Environment'

# Check function code signing
aws lambda get-function --function-name FUNC \
  --query 'Configuration.CodeSigningConfigArn'
```

### GCP Cloud Function Security

```bash
# List functions and their runtimes
gcloud functions list --format='table(name,runtime,status)'

# Check function IAM
gcloud functions get-iam-policy FUNCTION --region REGION
```

## Workflow

```bash
node scripts/agent.js --action audit --namespace production
cat /tmp/detecting-serverless-cold-start-attacks-audit.json | jq '.findings[]'
```

## Detection

```yaml
title: Serverless Cold Start Attacks Detection
id: 86085c18-c120-406f-b89a-22b457029730
status: experimental
description: Detects suspicious activity related to detecting serverless cold start attacks techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1059.009
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Serverless Cold Start Attacks Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1059.009 |

## Verification

- [ ] All Lambda functions use code signing configuration
- [ ] Third-party layers verified and pinned to versions
- [ ] No hardcoded secrets in function environment variables
- [ ] Init duration monitoring alerts configured
- [ ] Function execution roles follow least-privilege
- [ ] VPC configuration enforced for internal-access functions

## References

- [AWS Lambda Security Best Practices](https://docs.aws.amazon.com/lambda/latest/dg/lambda-security.html)
- [OWASP Serverless Top 10](https://owasp.org/www-project-serverless-top-10/)
- [GCP Cloud Functions Security](https://cloud.google.com/functions/docs/securing/)
- [MITRE ATT&CK T1059.009 — Cloud API](https://attack.mitre.org/techniques/T1059/009/)
