Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
New or privileged principals V-003
Finds IAM users and roles created outside your deployment pipeline, and new principals that gain power or keys within minutes.
Checks
| Checks | Needs |
|---|---|
| Finds a new IAM user given privileges or credentials within 15 minutes of being created. | Live events: identity, Live events: key, Live events: deploy |
| Says when a new user changed within 15 minutes but its privileges could not be read. | Live events: identity, Live events: key, Live events: deploy |
| Finds the default version of an attached policy changed by a non-deployer. | Live events: identity, Live events: key, Live events: deploy |
| Says when a policy's default version changed but where it is attached could not be read. | Live events: identity, Live events: key, Live events: deploy |
| Finds the deployer role passed to CloudFormation by a principal outside the pipeline. | Live events: identity, Live events: key, Live events: deploy |
| Finds an IAM user created by a principal other than your deployer. | iam user, Live events: identity, Live events: key, Live events: deploy |
| Finds an IAM role created by a principal other than your deployer. | iam role, Live events: identity, Live events: key, Live events: deploy |
| Notes a role that Warden itself installs being created. | iam role, Live events: identity, Live events: key, Live events: deploy |
| Notes a service-linked role created for an AWS service. | iam role, Live events: identity, Live events: key, Live events: deploy |
| Finds a principal that is new since the last run with no creation event seen. | iam user, iam role, Live events: identity, Live events: key, Live events: deploy |
| Says when new principals were created before the event window can show. | iam user, iam role, Live events: identity, Live events: key, Live events: deploy |
| Notes a role that Warden itself installed and that is new since the last run. | iam user, iam role, Live events: identity, Live events: key, Live events: deploy |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
12 open findings See them grouped
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1098 T1136.003
How to fix
GetUser/GetRole + attached and inline policies → detach the admin grant; reversible