Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Standing admin and privilege escalation V-010
Finds principals with standing administrator rights, or with grants that let them raise their own privileges.
Checks
| Checks | Needs |
|---|---|
| Finds principals with standing administrator rights, or with grants that let them raise their own privileges. | iam user, iam role, iam group, iam policy, iam access key, iam credential report, eks nodegroup, eks pod identity assoc |
Coverage
Read everywhere
| global | ‹payments-prod-cluster› | |
|---|---|---|
‹prod-acct› 123456789012 | Read | Read |
Run history
No run has recorded this rule yet.
Findings
12 open findings See them grouped
What it fed
Techniques
None mapped.
How to fix
GetPolicyVersion of the offending document → scope down by PR; reversible