Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Probing, unused regions and credential-use anomalies V-017
Finds hosts talking to known-bad addresses, and principals sweeping many regions or straying from their usual sign-in pattern.
Checks
| Checks | Needs |
|---|---|
| Finds hosts connecting out to a Tor exit or a known-bad address. | flow egress peer |
| Finds one principal calling into five or more regions within a minute. | Live events: write_sample |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
warden show (the cited events), GetAccessKeyLastUsed and the credential report for the principal → decide person, machine or stolen credential; a stolen one is deactivated (not deleted) by IaC as R-17, a person's new network is recorded; read-only until then