Hands-On AWS Penetration Testing with Kali Linux

Using Lambda functions as persistent watchdogs

Now, creating our persistent backdoors in an account is extremely useful, but what if even those get detected and removed from the environment? We can use AWS Lambda as a watchdog to monitor activity in the account and to run commands in response to certain events, allowing us to react to a defender's actions.

Basically, AWS Lambda is how you run serverless code in AWS. In simple terms, you upload your code (whether that is Node.js, Python, or whatever) and set up a trigger for your function so that, when that trigger is hit, your code executes in the cloud and does something with the incoming data.

We attackers can use this to our advantage in many ways. We can use it to alert on activity in ...