Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
KMS Sign behaviour V-005
Finds signing keys used in unusual volume, by unusual callers or outside their usual pattern.
Checks
| Checks | Needs |
|---|---|
| Finds a principal signing with a key it never signed with in the last thirty days. | Live events: sign, Sign |
| Finds a known signer's busiest hour above its usual daily volume by three standard deviations. | Live events: sign, Sign |
| Finds one key signed in an hour by three or more principals in an even split, most of them new to it. | Live events: sign, Sign |
| Finds signing, encryption or decryption refused or not found more than twenty times in an hour by one principal. | Live events: sign, Sign, Live events: sign, Decrypt, Live events: sign, Encrypt |
| Finds public keys read across more than ten different keys in an hour by one principal. | Live events: sign, GetPublicKey |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
DescribeKey → CancelKeyDeletion decision within the waiting period; reversible