Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Decoy touched V-045
Raises an alarm when any of your registered decoys is used, read, looked up or changed.
Checks
| Checks | Needs |
|---|---|
| Raises an alarm when a decoy access key is used. | Live events: ember_probe |
| Raises an alarm when a decoy role is assumed. | Live events: ember_probe, AssumeRole |
| Raises an alarm when a decoy parameter is read. | Live events: ember_probe |
| Raises an alarm when a decoy secret is read. | Live events: ember_probe |
| Raises an alarm when a decoy key is used. | Live events: sign |
| Raises an alarm when a decoy is changed or removed. | Live events: key, Live events: trust |
| Raises an alarm when a decoy is looked up by name. | Live events: ember_probe |
| Raises an alarm when a decoy shows a use the trail did not record. | iam credential report |
| Raises an alarm when a decoy is no longer as it was registered. | iam access key, iam role |
Coverage
Read everywhere
| global | |
|---|---|
‹prod-acct› 123456789012 | Read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1078.004 T1552
How to fix
warden show (the cited events) and the caller's other calls in the window → contain the caller's credential by IaC (deactivate, not delete; a role through quarantine); leave the ember untouched; read-only on the ember