Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Audit-logging and detection setup and tamper V-002
Checks that audit trails, their buckets and keys, cluster audit logs and GuardDuty are on, and catches anyone turning them off.
Checks
| Checks | Needs |
|---|---|
| Checks that a multi-region trail covers the account. | cloudtrail trail |
| Says when trail coverage could not be read, instead of calling the account covered. | cloudtrail trail |
| Checks that an organization trail covers every account. | cloudtrail trail |
| Says when the organization trail requirement could not be read. | cloudtrail trail |
| Checks that each trail is logging. | cloudtrail trail |
| Checks that each trail validates its log files. | cloudtrail trail |
| Checks that each trail records all management events. | cloudtrail trail |
| Says when a trail's event selectors could not be read. | cloudtrail trail |
| Checks that each trail delivered logs within the last 60 minutes. | cloudtrail trail |
| Checks that a trail's delivery to CloudWatch Logs is present and current where it is required. | cloudtrail trail |
| Says when the CloudWatch Logs delivery decision could not be read. | cloudtrail trail |
| Checks that object-level data events are recorded for sensitive buckets. | cloudtrail trail |
| Says when data-event coverage for sensitive buckets could not be decided. | cloudtrail trail |
| Checks that a trail's encryption key is enabled and not scheduled for deletion. | cloudtrail trail, kms key |
| Says when a trail's encryption key could not be read. | cloudtrail trail, kms key |
| Says when the use of a trail's encryption key could not be read. | cloudtrail trail, kms key |
| Says when a trail's bucket could not be read. | cloudtrail trail, s3 bucket |
| Checks that a trail's bucket blocks all public access. | cloudtrail trail, s3 bucket |
| Checks that a trail's bucket keeps object versions. | cloudtrail trail, s3 bucket |
| Checks that a trail's bucket policy does not make it public. | cloudtrail trail, s3 bucket |
| Checks that a trail's bucket policy admits CloudTrail only with a source condition. | cloudtrail trail, s3 bucket |
| Checks that a trail's bucket has access logging on. | cloudtrail trail, s3 bucket |
| Checks that a trail's bucket lifecycle does not expire audit logs early. | cloudtrail trail, s3 bucket |
| Says when a trail bucket's lifecycle and access logging could not be read. | cloudtrail trail, s3 bucket |
| Checks that each cluster sends its audit log. | eks cluster |
| Checks that each cluster sends its authenticator log. | eks cluster |
| Says when a cluster's control-plane logging could not be read. | eks cluster |
| Checks that GuardDuty has a detector in every enabled region. | guardduty detector |
| Says when GuardDuty detector presence could not be read. | guardduty detector |
| Checks that each GuardDuty detector is enabled. | guardduty detector |
| Checks that each GuardDuty protection feature is on. | guardduty detector |
| Checks that the GuardDuty administrator is inside your organization. | guardduty detector |
| Checks that each account's relationship with its GuardDuty administrator is enabled. | guardduty detector |
| Checks that each account is a member of the organization's GuardDuty administrator. | guardduty detector |
| Says when GuardDuty administrator membership could not be read. | guardduty detector |
| Checks that the GuardDuty publishing destination is working. | guardduty detector, s3 bucket |
| Says when the owner of the GuardDuty publishing destination could not be read. | guardduty detector, s3 bucket |
| Catches a trail being stopped or deleted. | Live events: tamper |
| Catches a trail's configuration being changed. | Live events: tamper |
| Catches a trail's event selectors being changed. | Live events: tamper |
| Catches a trail's insight selectors being changed. | Live events: tamper |
| Catches a trail's encryption key being disabled or scheduled for deletion. | Live events: tamper |
| Says when a key changed but the trails it affects could not be read. | Live events: tamper |
| Catches a trail bucket's lifecycle or policy being changed. | Live events: tamper |
| Says when a bucket changed but whether it holds a trail could not be read. | Live events: tamper |
| Catches a cluster's control-plane logging being changed. | Live events: tamper |
| Catches a GuardDuty detector being changed. | Live events: tamper |
| Catches a GuardDuty finding filter being created or changed. | Live events: tamper |
| Catches a GuardDuty trusted address list being created or changed. | Live events: tamper |
| Catches a GuardDuty threat list being deleted. | Live events: tamper |
| Catches a GuardDuty publishing destination being deleted. | Live events: tamper |
| Catches an account leaving its GuardDuty administrator. | Live events: tamper |
| Catches GuardDuty findings being archived. | Live events: tamper |
Coverage
Could not read 2 of 3 places
| eu-west-1 | global | ‹payments-prod-cluster› | |
|---|---|---|---|
‹prod-acct› 123456789012 | Read | ||
| 234567890123 | Not read | ||
‹sandbox› 345678901234 | Not read |
Run history
No run has recorded this rule yet.
Findings
12 open findings See them grouped
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetTrailStatus / GetDetector confirm the state → restore via IaC; reversible