Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Probing and credential-use slice V-017a
Finds sign-in probing, principals on new networks, instance credentials used off their host and calls from known-bad addresses.
Checks
| Checks | Needs |
|---|---|
| Finds console sign-in attempts from an unknown network. | Live events: identity, Live events: write_sample |
| Finds a principal active from a network it has never used. | Live events: identity, Live events: write_sample |
| Finds refused calls from a principal outside your organization. | Live events: identity, Live events: write_sample |
| Finds instance role credentials used away from their instance. | Live events: identity, Live events: write_sample |
| Finds several principals working as one fleet from one network. | Live events: identity, Live events: write_sample |
| Finds a spike of refused calls from a principal in your organization. | Live events: identity, Live events: write_sample |
| Finds a port scan against a public host from one network. | flow source |
| Finds repeated connections to an admin or database port from one source. | flow source |
| Finds calls answered for a Tor exit or a known-bad address. | Live events: identity, Live events: write_sample |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
warden show (the cited events), GetAccessKeyLastUsed and the credential report for the principal → decide person, machine or stolen credential; a stolen one is deactivated (not deleted) by IaC as R-17, a person's new network is recorded; read-only until then