Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Rules
Every check Warden runs for you, and every rule of yours: what it checks, what it last found, and what it fed.
328 checks in 71 rules and 4 packs, mapped to 16 attack techniques; 0 rules of yours.
| Rule | What it checks | Severity | Status | Coverage | Last result | 30 days | Fed |
|---|---|---|---|---|---|---|---|
Credential-shaped inline value in workload configuration V-001Warden | Finds access keys, tokens and other secrets written in plain text into workload definitions and pod configuration. | High to Critical | Live | Read everywhere | No result yet | 1 case | |
Audit-logging and detection setup and tamper V-002Warden | Checks that audit trails, their buckets and keys, cluster audit logs and GuardDuty are on, and catches anyone turning them off. | High to Critical | Live | Could not read 2 of 3 places | No result yet | Nothing yet | |
New or privileged principals V-003Warden | Finds IAM users and roles created outside your deployment pipeline, and new principals that gain power or keys within minutes. | Info to Critical | Live | Read everywhere | No result yet | Nothing yet | |
Access-key anomalies V-004Warden | Finds access keys minted in bursts or for other users, keys used after revocation, and users holding more than one active key. | High to Critical | Live | Read everywhere | No result yet | 1 case | |
KMS Sign behaviour V-005Warden | Finds signing keys used in unusual volume, by unusual callers or outside their usual pattern. | High to Critical | In a pack not yet adopted | Could not read anything this run | No result yet | Nothing yet | |
Key control plane V-006Warden | Finds signing keys, their policies, grants and aliases changed outside the deployment pipeline. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Wildcard signing grants V-007Warden | Finds key policies and grants that let any principal sign with a key. | High to Critical | In a pack not yet adopted | Read everywhere | No result yet | Nothing yet | |
Snapshot and export exfiltration V-008Warden | Finds snapshots, images and databases made public or shared outside your organization, and unexpected copies or exports. | Low to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Trust surface V-009Warden | Finds roles that outside accounts, any principal or unbound web identities can assume, and changes to who may assume a role. | Info to Critical | Live | Read everywhere | No result yet | Nothing yet | |
Standing admin and privilege escalation V-010Warden | Finds principals with standing administrator rights, or with grants that let them raise their own privileges. | High | Live | Read everywhere | No result yet | 1 case | |
Resource-policy and organization perimeter V-011Warden | Finds resource policies and shared documents that admit principals outside your organization. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Organization perimeter slice V-011aWarden | Checks that organization policies keep outside principals and tampering out, and that the management account runs no workloads. | High | Live | Read everywhere | No result yet | Nothing yet | |
Cluster-admin surface V-012Warden | Finds bindings, roles, access entries and aws-auth mappings that hand out cluster administrator rights. | Medium to Critical | Live | Read everywhere | No result yet | Nothing yet | |
IMDS setup V-013Warden | Finds launch templates and node groups that start instances on the older instance metadata service or with a high hop limit. | High | Live | Read everywhere | No result yet | Nothing yet | |
IMDS setup slice V-013aWarden | Checks that instances and account defaults require the newer instance metadata service with a hop limit of one. | Low to High | Live | Read everywhere | No result yet | 1 case | |
Edge bypass and exposure V-014Warden | Finds databases open to the internet, and origins that can be reached around the CDN meant to front them. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
EKS public endpoint slice V-014aWarden | Finds cluster API endpoints that are open to the internet. | High | Live | Read everywhere | No result yet | Nothing yet | |
Internet exposure slice V-014bWarden | Finds public instances whose security groups open all ports, database ports or admin ports to the internet. | Low to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
S3 public exposure V-015Warden | Finds buckets that anyone can read, whose public access block is off, or whose policy trusts a Referer header. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
S3 public-access slice V-015aWarden | Checks that the account and the trail buckets block public access. | High | Live | Could not read anything this run | No result yet | Nothing yet | |
Post-revocation success V-016Warden | Finds revoked credentials and identities that still succeed, or mint new credentials, after their revocation. | Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Probing, unused regions and credential-use anomalies V-017Warden | Finds hosts talking to known-bad addresses, and principals sweeping many regions or straying from their usual sign-in pattern. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Probing and credential-use slice V-017aWarden | Finds sign-in probing, principals on new networks, instance credentials used off their host and calls from known-bad addresses. | Low to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Secret-store reconnaissance V-018Warden | Finds sweeps of secrets, parameters and key decryption that look like someone harvesting credentials. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
GuardDuty triage V-019Warden | Triages GuardDuty findings against what Warden itself saw. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
GuardDuty parity slice V-019aWarden | Checks every GuardDuty finding against Warden's own records and names the ones its own sensors missed. | Info to Medium | Live | Could not read anything this run | No result yet | Nothing yet | |
Cognito setup and abuse V-020Warden | Checks user pool settings such as self sign-up and MFA, and finds abuse of identity pools. | Low to High | In a pack not yet adopted | Could not read anything this run | No result yet | Nothing yet | |
Identity pool abuse slice V-020aWarden | Finds identity pool accounts created by hand, pools listed at volume, sign-ups at volume and settings changed outside the pipeline. | Low to High | In a pack not yet adopted | Could not read anything this run | No result yet | Nothing yet | |
Network-position trust V-021Warden | Finds allowlists that trust a network address alone, such as your own egress address or partner addresses pinned one by one. | High | Live | Could not read anything this run | No result yet | Nothing yet | |
Root and console hygiene V-022Warden | Checks the root account for keys, MFA and recent use, and console users for MFA and unexpected sign-ins. | Medium to Critical | Live | Read everywhere | No result yet | Nothing yet | |
Registry exfiltration and provenance V-023Warden | Finds container images pulled or copied out of your registries, and images without provenance. | Low to High | Live | Could not read anything this run | No result yet | Nothing yet | |
Persistence and alert-cut V-024Warden | Finds new ways to keep access, such as trust anchors, integrations and layers, and changes that cut alerting or logging. | Info to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Coverage and self-integrity V-025Warden | Checks that every read Warden planned came back, that its own sensors are healthy, and that nothing has silenced it. | Info to Critical | Live | Read everywhere | No result yet | Nothing yet | |
Compute and AI hijack V-026Warden | Finds GPU, fleet, ML and model access started by principals that never did so before, and AI or mail controls changed. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
S3 impact and exfiltration V-027Warden | Finds bucket versioning, encryption or lifecycle changed by a non-deployer, replication out, and bursts of reads, deletes or egress. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Identity Center principals and assignments V-028Warden | Compares Identity Center users, groups, permission-set assignments and MFA settings, and flags assignments by a non-deployer. | Medium to High | Live | Could not read anything this run | No result yet | Nothing yet | |
EKS audit-log behaviours V-029Warden | Reads the cluster audit log for pod exec, secret listing, new cluster role bindings, anonymous requests and aws-auth edits. | High to Critical | Live | Read everywhere | No result yet | Nothing yet | |
GitOps and IaC drift V-030Warden | Finds workloads, scheduled jobs and webhooks created or changed outside your GitOps identity. | Medium to High | Live | Could not read anything this run | No result yet | Nothing yet | |
Privileged workload setup V-031Warden | Finds privileged pods, pods sharing the host's namespaces, sensitive host mounts and root pods outside the allowed system namespaces. | Medium to High | Live | Could not read anything this run | No result yet | Nothing yet | |
Host execution through cloud APIs V-032Warden | Finds commands, shell sessions and SSH keys pushed to hosts through cloud APIs by a non-deployer. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
CI/CD identity and project surface V-033Warden | Checks build and pipeline roles, source credentials, webhook filters and the subjects CI identities are trusted for. | Medium to High | Live | Read everywhere | No result yet | Nothing yet | |
AI and agent surface V-034Warden | Finds model tooling and agent servers exposed without authentication, and coding-agent identities with administrative access. | Medium to High | Live | Read everywhere | No result yet | Nothing yet | |
Credential-consumer inventory V-035Warden | Maps every active access key to an owner and a consumer, and flags keys that are unmapped or shared. | Medium to High | Live | Read everywhere | No result yet | Nothing yet | |
Enclave-gated key setup V-036Warden | Checks that enclave-gated keys require current attestation, and that enclave hosts have not drifted. | High to Critical | In a pack not yet adopted | Read everywhere | No result yet | Nothing yet | |
Frontend asset integrity V-037Warden | Finds writes to CDN origin buckets by principals other than CI, distribution and edge function changes, and missing origin access control. | High to Critical | In a pack not yet adopted | Could not read anything this run | No result yet | Nothing yet | |
CloudHSM control plane and audit V-038Warden | Finds hardware security module clusters, HSMs and backups deleted, copied out, restored or reshared by anyone but the deployer. | High to Critical | In a pack not yet adopted | Could not read anything this run | No result yet | Nothing yet | |
On-chain hot-wallet invariants V-039Warden | Watches hot wallets for balance and nonce drift, unexpected outbound transfers and signer-set changes. | High to Critical | In a pack not yet adopted | Could not read anything this run | No result yet | Nothing yet | |
Application token stores and plaintext recovery secrets V-040Warden | Finds application tokens with no expiry or owner, tokens issued after a revocation, and recovery secrets stored in plain text. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
Idle and dangling identity V-041Warden | Finds roles, users, keys and identity providers that nobody has used for 90 days or that point at something gone. | Low to Critical | Live | Read everywhere | No result yet | Nothing yet | |
Principal behaviour off its own baseline V-043Warden | Compares each principal with its own history and flags new kinds of calls, new regions, new clients, odd hours and volume spikes. | Info to High | Live | Could not read anything this run | No result yet | Nothing yet | |
Text planted to steer an AI reviewer V-044Warden | Finds text planted in your resources to steer an AI reviewer, and names who wrote it. | Info to High | Live | Could not read anything this run | No result yet | Nothing yet | |
Decoy touched V-045Warden | Raises an alarm when any of your registered decoys is used, read, looked up or changed. | High to Critical | Live | Read everywhere | No result yet | Nothing yet | |
Known vulnerability in running software V-046Warden | Finds software in your AWS accounts that a published advisory says is vulnerable, and ranks each one by whether it is being exploited, reachable and powerful. | Info to High | Live | Read everywhere | No result yet | Nothing yet | |
Exploited or exploitable vulnerability with a path to harm V-047Warden | Finds a vulnerability that is already being exploited or has a public exploit, on software that can be reached and that holds powerful access. | High to Critical | Live | Could not read anything this run | No result yet | Nothing yet | |
End of support and out-of-date platforms V-048Warden | Finds clusters, databases, runtimes, operating systems and images that are at or near the end of support, and machine images that have aged too far. | Low to High | Live | Read everywhere | No result yet | Nothing yet | |
AWS security update waiting V-049Warden | Finds security updates and maintenance that AWS has published for services you run and that nobody has applied. | Low to High | Live | Read everywhere | No result yet | Nothing yet | |
Vulnerability blind spots V-050Warden | Finds the places where the vulnerability scanner cannot see what you run, grouped by account and region, with what turning it on costs. | Info to Medium | Live | Read everywhere | No result yet | Nothing yet | |
LOW hygiene pack V-100Warden | Checks low-severity hygiene: password policy, database encryption and zones, bucket versioning, CloudShell access and a security contact, without alerting. | Low | Live | Could not read 1 of 2 places | No result yet | Nothing yet | |
Event lane rule 01 LR-01Event lane | Catches anyone stopping or changing a trail, a detector, a config recorder or flow logs, even when the attempt is refused. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 02 LR-02Event lane | Catches any touch of one of your decoys, even when the attempt is refused. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 03 LR-03Event lane | Catches a principal creating an access key or console password for another user, and every console password change. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 04 LR-04Event lane | Catches one line of identities creating three or more users, roles, keys or console passwords within 10 minutes. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 05 LR-05Event lane | Catches administrator rights being granted, and role trust being opened to an account outside your accounts. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 06 LR-06Event lane | Catches snapshots and images shared outward, buckets opened to the public and function URLs with no authentication. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 07 LR-07Event lane | Catches GPU instances launched, more than 20 instances by one principal, or launches in three or more regions within 10 minutes. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 08 LR-08Event lane | Catches root activity, console sign-ins without MFA and bursts of failed console sign-ins. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 09 LR-09Event lane | Catches one session calling in six or more regions within 5 minutes. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 10 LR-10Event lane | Catches one principal making 40 or more distinct read calls within 10 minutes. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 11 LR-11Event lane | Catches any write on a Warden resource by a principal that is not Warden's, even when the attempt is refused. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 12 LR-12Event lane | Catches a write by a principal on its first ever call from a network. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet | |
Event lane rule 13 LR-13Event lane | Catches model invocation logging being changed, model access being opened and a principal's first model use. | Set by the match | Live | Could not read anything this run | Event lane results could not be read | Nothing yet |