---
title: AWS Lambda Function Deletion by Unusual User
description: Identifies when an unusual user deletes an AWS Lambda function. Deleting a function removes its code, configuration, versions, and aliases. Adversaries...
url: https://www.elastic.co/elastic/docs-builder/docs/4384/reference/security/prebuilt-rules/rules/integrations/aws/impact_lambda_function_deleted
products:
  - Elastic Security
---

# AWS Lambda Function Deletion by Unusual User
Identifies when an unusual user deletes an AWS Lambda function. Deleting a function removes its code, configuration,
versions, and aliases. Adversaries may delete functions to disrupt business operations and automated workflows, to
destroy attacker-deployed backdoors and remove evidence after achieving their objective, or to inhibit incident
response. Because function deletion is destructive and often irreversible without redeployment, deletions performed by
unexpected principals or outside change windows should be reviewed. This is a New Terms rule that uses
"cloud.account.id", "user.name", and "aws.cloudtrail.flattened.request_parameters.functionName" to alert on the first
time a given identity in an account successfully deletes a specific Lambda function within the history window.
**Rule type**: new_terms
**Rule indices**:
- logs-aws.cloudtrail-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 5m
**Searches indices from**: `now-6m`
**Maximum alerts per execution**: 100
**References**:
- [[https://docs.aws.amazon.com/lambda/latest/api/API_DeleteFunction.html](https://docs.aws.amazon.com/lambda/latest/api/API_DeleteFunction.html)](https://docs.aws.amazon.com/lambda/latest/api/API_DeleteFunction.html)
- [[https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html](https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html)](https://docs.aws.amazon.com/lambda/latest/dg/logging-using-cloudtrail.html)

**Tags**:
- Domain: Cloud
- Data Source: AWS
- Data Source: Amazon Web Services
- Platform: AWS
- Data Source: AWS CloudTrail
- Service: AWS Lambda
- Tactic: Impact
- Rule Type: New Terms
- Resources: Investigation Guide
- Noise: Medium
- Performance: Fast

**Version**: 4
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating AWS Lambda Function Deletion by Unusual User

Deleting an AWS Lambda function removes its code, configuration, published versions, and aliases. This can be a destructive action that disrupts serverless workloads and automation, or a cleanup step an adversary uses to remove a backdoor function and erase evidence after their objective is met.
This rule uses a New Terms approach to detect the first time a given identity in an account successfully deletes a Lambda function (`DeleteFunction`). Investigate whether the principal and the deleted function are expected, and whether the deletion correlates with other suspicious activity.

#### Possible investigation steps

- Identify the actor in `aws.cloudtrail.user_identity.arn` and `aws.cloudtrail.user_identity.type`, and review `source.ip` and `user_agent.original` to determine how the deletion was performed (console, CLI, SDK, automation).
- Inspect `aws.cloudtrail.flattened.request_parameters.functionName` and map the function to its application, owner, and environment (prod, staging, dev).
- Determine whether the deletion aligns with an approved change, decommissioning, or infrastructure-as-code destroy operation by comparing `@timestamp` against deployment and change-management records.
- Correlate with recent activity by the same principal or access key, such as `CreateFunction`, `UpdateFunctionCode`, `AddPermission`, `CreateEventSourceMapping`, log-group deletions, or other destructive or evasive actions.
- Verify whether multiple functions were deleted in a short window, which may indicate broad disruption rather than a single planned change.


### False positive analysis

- Function deletions are common during decommissioning and infrastructure-as-code apply/destroy cycles. Deletions by approved deployment roles, CI/CD pipelines, or platform automation are expected. Tune on `aws.cloudtrail.user_identity.arn`, `user_agent.original`, or known automation roles after validation.


### Response and remediation

- If the deletion is unauthorized, restore the function from source control or an infrastructure-as-code definition and confirm its code, configuration, and execution role match a known-good state.
- Review CloudTrail for related destructive or evasive actions by the same actor and assess operational impact.
- Rotate or restrict credentials for the principal if compromise is suspected, and constrain `lambda:DeleteFunction` to a small set of trusted roles.


## Rule Query

```kuery
data_stream.dataset: "aws.cloudtrail"
    and event.provider: "lambda.amazonaws.com"
    and event.action: (DeleteFunction or DeleteFunction20*)
    and event.outcome: "success"
    and user.name: (* and not AWSServiceRoleForLambdaReplicator)
    and aws.cloudtrail.flattened.request_parameters.functionName: *
    and not user_agent.original: (*Pulumi* or *Terraform*)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Impact
- Id: TA0040
- Reference URL: [[https://attack.mitre.org/tactics/TA0040/](https://attack.mitre.org/tactics/TA0040/)](https://attack.mitre.org/tactics/TA0040/)
- Technique:
  - Name: Data Destruction
- Id: T1485
- Reference URL: [[https://attack.mitre.org/techniques/T1485/](https://attack.mitre.org/techniques/T1485/)](https://attack.mitre.org/techniques/T1485/)
- Technique:
  - Name: Service Stop
- Id: T1489
- Reference URL: [[https://attack.mitre.org/techniques/T1489/](https://attack.mitre.org/techniques/T1489/)](https://attack.mitre.org/techniques/T1489/)