Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Registry exfiltration and provenance V-023
Finds container images pulled or copied out of your registries, and images without provenance.
Checks
| Checks | Needs |
|---|---|
| Checks that no repository policy lets everyone pull its images. | ecr repository |
| Checks that no repository policy lets an account outside your organization pull images. | ecr repository |
| Checks that image tags in a repository cannot be overwritten. | ecr repository |
| Checks that running images come only from registries you allow. | k8s workload, k8s pod |
| Checks that running images are pinned by digest rather than by a movable tag. | k8s workload, k8s pod |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
LookupEvents replay for the scope, warden show (receipt) → raise the budget, fix delegation or the spoke trust by PR; read-only