Serverless

{
  "id": "ATTACK:enterprise:T1583.007",
  "title": "Serverless",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1583/007",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--04a5a8ab-3bc8-4c83-95c9-55274a89786d",
  "external_id": "T1583.007",
  "domain": "enterprise",
  "created": "2022-07-08T12:39:29.684Z",
  "modified": "2025-04-15T23:06:30.913Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "resource-development"
  ],
  "source_references": [
    {
      "source_name": "AWS Lambda Redirector",
      "url": "https://blog.xpnsec.com/aws-lambda-redirector/"
    },
    {
      "source_name": "Detecting Command & Control in the Cloud",
      "url": "https://awakesecurity.com/blog/threat-hunting-series-detecting-command-control-in-the-cloud/"
    },
    {
      "source_name": "BlackWater Malware Cloudflare Workers",
      "url": "https://www.bleepingcomputer.com/news/security/blackwater-malware-abuses-cloudflare-workers-for-c2-communication/"
    },
    {
      "source_name": "GWS Apps Script Abuse 2021",
      "url": "https://www.bleepingcomputer.com/news/security/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/#google_vignette"
    }
  ]
}