Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Principal behaviour off its own baseline V-043
Compares each principal with its own history and flags new kinds of calls, new regions, new clients, odd hours and volume spikes.
Checks
| Checks | Needs |
|---|---|
| Finds a principal using a kind of call it has not used before. | Live events: write_sample |
| Finds a principal acting in a region it has not used before. | Live events: write_sample |
| Finds a principal using a client it has not used before. | Live events: write_sample |
| Finds a principal acting at an hour of the week outside its routine. | Live events: write_sample |
| Finds a principal using a privilege tier for the first time. | Live events: write_sample |
| Finds a principal making far more calls than it usually does. | Live events: write_sample |
| Finds several departures from one principal's routine within two hours. | Live events: write_sample |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1078
How to fix
warden show (the cited events), GetAccessKeyLastUsed and the credential report for the principal → decide person, machine or stolen credential; a stolen one is deactivated (not deleted) by IaC as R-17, a person's new network is recorded; read-only until then