Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Known vulnerability in running software V-046
Finds software in your AWS accounts that a published advisory says is vulnerable, and ranks each one by whether it is being exploited, reachable and powerful.
Checks
| Checks | Needs |
|---|---|
| Finds an installed package or binary that a published advisory says is vulnerable. | sw package |
| Finds a kernel, cluster component, managed engine or runtime version that a published advisory says is vulnerable. | sw platform |
| Finds an official image whose tag falls in a vulnerable version range, one step below a confirmed match. | sw image |
| Finds a weakness that Amazon Inspector's code scanning reports in a function. | insp finding |
| Finds a package whose name and version are listed as malicious on a public registry, when nothing yet shows which registry yours came from. | sw package |
| Finds an advisory first published in the last day that matches software in your accounts, one finding per advisory group. | sw package |
Coverage
Read everywhere
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1068 T1190 T1203 T1210
How to fix
warden show for the cited record and the advisory → the fix unit the finding names: move the image to a fixed digest, the package to the fixed version or the engine to a fixed release, by IaC or GitOps (reversible); read-only until then