Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Host execution through cloud APIs V-032
Finds commands, shell sessions and SSH keys pushed to hosts through cloud APIs by a non-deployer.
Checks
| Checks | Needs |
|---|---|
| Finds commands, shell sessions and SSH keys pushed to hosts through cloud APIs by a non-deployer. | Live events: host_exec |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
LookupEvents replay for the scope, warden show (receipt) → raise the budget, fix delegation or the spoke trust by PR; read-only