Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Post-revocation success V-016
Finds revoked credentials and identities that still succeed, or mint new credentials, after their revocation.
Checks
| Checks | Needs |
|---|---|
| Finds revoked credentials and identities that still succeed, or mint new credentials, after their revocation. | Live events: key, Live events: tamper, Live events: session_mint |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetAccessKeyLastUsed per key (read-only) → unknown owner: deactivate (not delete), watch 14 d