Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1648_serverless-execution
Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments.
Passed 19 of 23 test cases with the skill, and 12 of 23 without it.
and 8 more in the full report
7 fixed12 passed either way4 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
In Google Workspace, an adversary deployed a Google Apps Script that triggers when users open shared Google Drive files. What mitigation category controls high-risk OAuth scope usage for these scripts?
| Checked | Without skill | With skill |
|---|---|---|
| The response specifies mitigation code M1036 Account Use Policies. | Missed | Passed |
| The response recommends restricting access to high-risk OAuth scopes in Google Apps Script. | Passed | Passed |
The instructions your model reads when the skill loads.
Adversaries may abuse serverless computing, integration, and automation services to execute arbitrary code in cloud environments. Many cloud providers offer a variety of serverless resources, including compute engines, application integration services, and web servers.
Adversaries may abuse these resources in various ways as a means of executing arbitrary commands. For example, adversaries may use serverless functions to execute malicious code, such as crypto-mining malware (i.e. Resource Hijacking). Adversaries may also create functions that enable further compromise of the cloud environment. For example, an adversary may use the IAM:PassRole permission in AWS or the iam.serviceAccounts.actAs permission in Google Cloud to add Additional Cloud Roles to a serverless cloud function, which may then be able to perform actions the original user cannot.
Serverless functions can also be invoked in response to cloud events (i.e. Event Triggered Execution), potentially enabling persistent execution over time. For example, in AWS environments, an adversary may create a Lambda function that automatically adds Additional Cloud Credentials to a user and a corresponding CloudWatch events rule that invokes that function whenever a new user is created. This is also possible in many cloud-based office application suites. For example, in Microsoft 365 environments, an adversary may create a Power Automate workflow that forwards all emails a user receives or creates anonymous sharing links whenever a user is granted access to a document in SharePoint. In Google Workspace environments, they may instead create an Apps Script that exfiltrates a user's data when they open a file.
Platforms: SaaS, IaaS, Office Suite
Identify Attack Surface: Determine if the target environment is susceptible to Serverless Execution by examining the target platforms (SaaS, IaaS, Office Suite).
Assess Existing Defenses: Review whether mitigations for T1648 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.