Rule library
// Detection
Cloud access key created outside change hours
A long-lived cloud credential minted outside the working window. Key creation is a normal action at an abnormal time.
HighInvestigating1alerts raisedOff hours
Armed
What this rule does
Rendered from the stored logic, so it cannot drift from what executes.
Events where action contains CreateAccessKey outside 07:00-19:00 UTC
{
"kind": "off_hours",
"where": [
{
"op": "contains",
"field": "action",
"value": "CreateAccessKey"
}
],
"endHour": 19,
"startHour": 7
}Revise
Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.
Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city
Alerts raised (1)
What this rule has actually caught.
| Alert | Finding | Status | Risk | Raised |
|---|---|---|---|---|
| ALT-701421 | bpatel created a long-lived access key for svc_deploy at 03:14 UTC, outside any approved change window. | New | 46 |
Rule
- Category
- Persistence
- ATT&CK tactic
- Persistence
- Technique
- T1098.001
- Kind
- Off hours
- State
- Armed
- Created
- 7d ago
- Last changed
- 7d ago
Firing history
- Total alerts
- 1
- First fired
- 8d ago
- Last fired
- 8d ago
- Escalated to cases
- 0
- Dismissed benign
- 0