Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Secret-store reconnaissance V-018
Finds sweeps of secrets, parameters and key decryption that look like someone harvesting credentials.
Checks
| Checks | Needs |
|---|---|
| Finds a principal whose secret reads were refused ten or more times within an hour. | Live events: ember_probe, GetSecretValue, Live events: ember_probe, BatchGetSecretValue |
| Finds a principal reading five or more secrets or parameters it never read before within an hour. | Live events: ember_probe, GetSecretValue, Live events: ember_probe, BatchGetSecretValue, Live events: ember_probe, GetParameter, Live events: ember_probe, GetParameters |
| Finds a principal that never listed the secret or parameter stores listing them repeatedly within an hour. | Live events: secret_recon, ListSecrets, Live events: secret_recon, DescribeParameters |
| Finds a principal that never walked a parameter path reading one with decryption. | Live events: ember_probe, GetParametersByPath |
| Finds key decryption in an hour far above what the principal's busiest recent day held. | Live events: sign, Decrypt, Live events: sign, GenerateDataKey, Live events: sign, GenerateDataKeyWithoutPlaintext |
| Finds instance passwords or launch template data read five or more times within an hour. | Live events: secret_recon, GetPasswordData, Live events: secret_recon, GetLaunchTemplateData |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
LookupEvents replay for the scope, warden show (receipt) → raise the budget, fix delegation or the spoke trust by PR; read-only