Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
S3 impact and exfiltration V-027
Finds bucket versioning, encryption or lifecycle changed by a non-deployer, replication out, and bursts of reads, deletes or egress.
Checks
| Checks | Needs |
|---|---|
| Catches bucket versioning suspended by a non-deployer. | Live events: bucket_impact |
| Catches a lifecycle rule set to expire a bucket's objects by a non-deployer. | Live events: tamper, PutBucketLifecycle, Live events: tamper, PutBucketLifecycleConfiguration |
| Catches bucket default encryption removed by a non-deployer. | Live events: bucket_impact |
| Catches a bucket replicated to a destination outside your organization. | Live events: bucket_impact |
| Finds objects written under a customer-supplied encryption key. | Live events: object_data |
| Finds a burst of object deletions from one bucket by one principal. | Live events: object_data |
| Finds a burst of object reads from a sensitive bucket by one principal. | Live events: object_data |
| Finds a host sending a large volume to unknown internet hosts. | flow egress peer |
| Says when object activity could not be read. | Live events: object_data |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
LookupEvents replay for the scope, warden show (receipt) → raise the budget, fix delegation or the spoke trust by PR; read-only