Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Identity pool abuse slice V-020a
Finds identity pool accounts created by hand, pools listed at volume, sign-ups at volume and settings changed outside the pipeline.
Checks
| Checks | Needs |
|---|---|
| Finds identity pool accounts created by hand, pools listed at volume, sign-ups at volume and settings changed outside the pipeline. | Live events: cognito |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1078.004 T1136.003
How to fix
warden show (the cited events) and AdminListUserAuthEvents / ListUsers for the pool (read-only) → decide pipeline, support tool or intruder; accounts minted by hand are disabled (AdminDisableUser, not deleted) by the owning team, a walked pool is treated as a customer-data incident, a changed pool is reverted by IaC; read-only until then