Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Root and console hygiene V-022
Checks the root account for keys, MFA and recent use, and console users for MFA and unexpected sign-ins.
Checks
| Checks | Needs |
|---|---|
| Finds a root account that holds an access key. | iam credential report |
| Finds a root account without MFA. | iam credential report |
| Finds root credentials used in the last 24 hours. | Live events: identity |
| Finds console users with a password and no MFA. | iam credential report |
| Catches a console password created or changed on an existing user. | Live events: identity, iam user |
| Finds an IAM user signing in to the console where federation is the norm. | Live events: identity, iam credential report, iam role, iam saml provider |
| Finds console sign-ins without MFA. | Live events: identity, iam credential report, iam role, iam saml provider |
| Catches an MFA device being deactivated or deleted. | Live events: identity, iam user |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
credential report row → enable MFA, deactivate the console password or root key (deactivate, not delete); reversible