Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Persistence and alert-cut V-024
Finds new ways to keep access, such as trust anchors, integrations and layers, and changes that cut alerting or logging.
Checks
| Checks | Needs |
|---|---|
| Flags a call that switched off or silenced a security tool, such as a recorder, a detector or an alarm. | Live events: alert_cut |
| Flags a new rule that makes a security tool archive or hide its findings. | Live events: alert_cut, Live events: tamper, CreateFilter, Live events: tamper, UpdateFilter |
| Flags a flood of tool-silencing calls that was too large to read in full. | Live events: alert_cut |
| Flags a deployer role used by hand instead of through the pipeline. | Live events: deploy |
| Flags a call that cut one of Warden's own alarms, topics, rules or log groups. | Live events: alarm_path |
| Flags an AWS Config recorder that exists in a region but is stopped or failing, so it records nothing. | config recorder |
| Flags Amazon Inspector turned off in a region where it was on at the last run. | insp status |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
GetTrailStatus / GetDetector confirm the state → restore via IaC; reversible