Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Access-key anomalies V-004
Finds access keys minted in bursts or for other users, keys used after revocation, and users holding more than one active key.
Checks
| Checks | Needs |
|---|---|
| Finds three or more access keys minted within 60 seconds. | Live events: key |
| Finds an access key used after it was deactivated or deleted. | Live events: key |
| Says when use after a key revocation could not be read. | Live events: key |
| Finds an access key minted on another user, or on a user whose existing key is old or idle. | iam access key, iam user, Live events: key |
| Finds users with more than one active access key, or an old key still active a week after rotation. | iam access key, iam user, Live events: key |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
13 open findings See them grouped
What it fed
Techniques
T1098.001
How to fix
GetAccessKeyLastUsed per key (read-only) → unknown owner: deactivate (not delete), watch 14 d