Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Exploited or exploitable vulnerability with a path to harm V-047
Finds a vulnerability that is already being exploited or has a public exploit, on software that can be reached and that holds powerful access.
Checks
| Checks | Needs |
|---|---|
| Finds a flaw that is being exploited in the wild, on running software that is open to the internet. | sw package |
| Finds a flaw that is being exploited in the wild, on running software whose identity can reach an administrator or a crown jewel. | sw package |
| Finds a takeover flaw with a public exploit, on internet-facing software whose identity can reach an administrator or a crown jewel. | sw package |
| Finds a vulnerable resource that also shows evidence of the flaw being used, dated after the vulnerable version started running. | guardduty finding, sw package |
| Finds a package proven malicious by its file hash, its registry or a squatter's version, running in your accounts. | sw package |
Coverage
Could not read anything this run
| eu-west-1 | |
|---|---|
‹sandbox› 345678901234 | Not read |
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
T1068 T1190 T1195.002 T1203
How to fix
warden show for the cited record, the advisory and the path → if the estate shows an attack, contain first by IaC (deactivate the workload identity's keys, isolate the workload; reversible) and read what the identity did; then move to the fixed version. A proven malicious package is an incident: stop the workload, keep its image for evidence