Rules
What Warden looks for.
Every rule it carries, in one sentence each. This page is generated from the catalogue in
the release, not written by hand: 53 code rules and
13 lane rules, read at commit 246a7f5712ee.
Three kinds of rule
Code rules ship in the release and read your account's records on each run. Lane rules read each CloudTrail event as it arrives, so the most urgent patterns do not wait for a run. Pack rules are data, not code: an optional, signed list a person adopts with one signature, each with a changelog in plain words.
Severity shows the lowest and highest level a rule can raise. ATT&CK techniques are the ones the rule's sources cite; a rule with none listed cites none. 35 of 53 code rules are in the current release. The rest are planned and are listed so the catalogue is complete; they watch nothing yet.
Code rules
Core
| Rule | What it checks | Severity | Techniques | Shipped in |
|---|---|---|---|---|
V-025 Coverage and self-integrity | Checks that every read Warden planned came back, that its own sensors are healthy, and that nothing has silenced it. | info to critical | none listed | In the current release |
V-001 Credential-shaped inline value in workload configuration | Finds access keys, tokens and other secrets written in plain text into workload definitions and pod configuration. | high to critical | none listed | In the current release |
V-002 Audit-logging and detection posture and tamper | Checks that audit trails, their buckets and keys, cluster audit logs and GuardDuty are on, and catches anyone turning them off. | high to critical | none listed | In the current release |
V-003 New or privileged principals | Finds IAM users and roles created outside your deployment pipeline, and new principals that gain power or keys within minutes. | info to critical |
| In the current release |
V-004 Access-key anomalies | Finds access keys minted in bursts or for other users, keys used after revocation, and users holding more than one active key. | high to critical |
| In the current release |
V-008 Snapshot and export exfiltration | Finds snapshots, images and databases made public or shared outside your organization, and unexpected copies or exports. | low to critical |
| In the current release |
V-009 Trust surface | Finds roles that outside accounts, any principal or unbound web identities can assume, and changes to who may assume a role. | info to critical | none listed | In the current release |
V-010 Standing admin and privilege escalation | Finds principals with standing administrator rights, or with grants that let them raise their own privileges. | high | none listed | In the current release |
V-012 Cluster-admin surface | Finds bindings, roles, access entries and aws-auth mappings that hand out cluster administrator rights. | medium to critical | none listed | In the current release |
V-022 Root and console hygiene | Checks the root account for keys, MFA and recent use, and console users for MFA and unexpected sign-ins. | medium to critical | none listed | In the current release |
V-011a Organization perimeter slice | Checks that organization policies keep outside principals and tampering out, and that the management account runs no workloads. | high | none listed | In the current release |
V-013a IMDS posture slice | Checks that instances and account defaults require the newer instance metadata service with a hop limit of one. | low to high |
| In the current release |
V-014a EKS public endpoint slice | Finds cluster API endpoints that are open to the internet. | high | none listed | In the current release |
V-014b Internet exposure slice | Finds public instances whose security groups open all ports, database ports or admin ports to the internet. | low to critical | none listed | In the current release |
V-015a S3 public-access slice | Checks that the account and the trail buckets block public access. | high | none listed | In the current release |
V-041 Idle and dangling identity | Finds roles, users, keys and identity providers that nobody has used for 90 days or that point at something gone. | low to critical |
| In the current release |
V-006 Key control plane | Finds signing keys, their policies, grants and aliases changed outside the deployment pipeline. | high to critical | none listed | Planned, not in the release yet |
V-011 Resource-policy and organization perimeter | Finds resource policies and shared documents that admit principals outside your organization. | high to critical | none listed | Planned, not in the release yet |
V-013 IMDS posture | Finds launch templates and node groups that start instances on the older instance metadata service or with a high hop limit. | high | none listed | In the current release |
V-014 Edge bypass and exposure | Finds databases open to the internet, and origins that can be reached around the CDN meant to front them. | high to critical | none listed | In the current release |
V-015 S3 public exposure | Finds buckets that anyone can read, whose public access block is off, or whose policy trusts a Referer header. | high to critical | none listed | In the current release |
V-016 Post-revocation success | Finds revoked credentials and identities that still succeed, or mint new credentials, after their revocation. | critical | none listed | In the current release |
V-017 Probing, unused regions and credential-use anomalies | Finds hosts talking to known-bad addresses, and principals sweeping many regions or straying from their usual sign-in pattern. | high to critical | none listed | In the current release |
V-017a Probing and credential-use slice | Finds sign-in probing, principals on new networks, instance credentials used off their host and calls from known-bad addresses. | low to critical | none listed | In the current release |
V-018 Secret-store reconnaissance | Finds sweeps of secrets, parameters and key decryption that look like someone harvesting credentials. | high to critical | none listed | Planned, not in the release yet |
V-019 GuardDuty triage | Triages GuardDuty findings against what Warden itself saw. | high to critical | none listed | In the current release |
V-019a GuardDuty parity slice | Checks every GuardDuty finding against Warden's own records and names the ones its own sensors missed. | info to medium | none listed | In the current release |
V-021 Network-position trust | Finds allowlists that trust a network address alone, such as your own egress address or partner addresses pinned one by one. | high | none listed | In the current release |
V-023 Registry exfiltration and provenance | Finds container images pulled or copied out of your registries, and images without provenance. | low to high | none listed | In the current release |
V-024 Persistence and alert-cut | Finds new ways to keep access, such as trust anchors, integrations and layers, and changes that cut alerting or logging. | info to critical | none listed | In the current release |
V-026 Compute and AI hijack | Finds GPU, fleet, ML and model access started by principals that never did so before, and AI or mail controls changed. | high to critical | none listed | In the current release |
V-027 S3 impact and exfiltration | Finds bucket versioning, encryption or lifecycle changed by a non-deployer, replication out, and bursts of reads, deletes or egress. | high to critical | none listed | In the current release |
V-028 Identity Center principals and assignments | Compares Identity Center users, groups, permission-set assignments and MFA settings, and flags assignments by a non-deployer. | medium to high | none listed | Planned, not in the release yet |
V-029 EKS audit-log behaviours | Reads the cluster audit log for pod exec, secret listing, new cluster role bindings, anonymous requests and aws-auth edits. | high to critical | none listed | In the current release |
V-030 GitOps and IaC drift | Finds workloads, webhooks and scheduled jobs created outside your GitOps identity, and resources whose live state differs from their code. | medium to high | none listed | Planned, not in the release yet |
V-031 Privileged workload posture | Finds privileged pods, pods sharing the host's namespaces, sensitive host mounts and root pods outside the allowed system namespaces. | medium to high | none listed | Planned, not in the release yet |
V-032 Host execution through cloud APIs | Finds commands, shell sessions and SSH keys pushed to hosts through cloud APIs by a non-deployer. | high to critical | none listed | In the current release |
V-033 CI/CD identity and project surface | Checks build and pipeline roles, source credentials, webhook filters and the subjects CI identities are trusted for. | medium to high | none listed | Planned, not in the release yet |
V-034 AI and agent surface | Finds model tooling exposed without authentication, coding-agent identities with production write access and agents without authorizers. | medium to high | none listed | Planned, not in the release yet |
V-035 Credential-consumer inventory | Maps every active access key to an owner and a consumer, and flags keys that are unmapped or shared. | medium to high | none listed | Planned, not in the release yet |
V-040 Application token stores and plaintext recovery secrets | Finds application tokens with no expiry or owner, tokens issued after a revocation, and recovery secrets stored in plain text. | high to critical | none listed | Planned, not in the release yet |
V-100 LOW hygiene pack | Checks low-severity hygiene such as the password policy, account contacts, encryption at rest and versioning, without alerting. | low | none listed | Planned, not in the release yet |
V-043 Principal behaviour off its own baseline | Compares each principal with its own history and flags new kinds of calls, new regions, new clients, odd hours and volume spikes. | info to high |
| In the current release |
V-044 Text planted to steer an AI reviewer | Finds text planted in your resources to steer an AI reviewer, and names who wrote it. | info to high | none listed | In the current release |
V-045 Decoy touched | Raises an alarm when any of your registered decoys is used, read, looked up or changed. | high to critical |
| In the current release |
Signing keys
| Rule | What it checks | Severity | Techniques | Shipped in |
|---|---|---|---|---|
V-005 KMS Sign behaviour | Finds signing keys used in unusual volume, by unusual callers or outside their usual pattern. | high to critical | none listed | Planned, not in the release yet |
V-007 Wildcard signing grants | Finds key policies and grants that let any principal sign with a key. | high to critical | none listed | Planned, not in the release yet |
V-036 Enclave-gated key posture | Checks that enclave-gated keys require current attestation, and that enclave hosts have not drifted. | high to critical | none listed | Planned, not in the release yet |
V-038 CloudHSM control plane and audit | Reads hardware security module control-plane events and audit logs for user and officer changes. | high to critical | none listed | Planned, not in the release yet |
V-039 On-chain hot-wallet invariants | Watches hot wallets for balance and nonce drift, unexpected outbound transfers and signer-set changes. | high to critical | none listed | Planned, not in the release yet |
Identity pools
| Rule | What it checks | Severity | Techniques | Shipped in |
|---|---|---|---|---|
V-020 Cognito posture and abuse | Checks user pool settings such as self sign-up and MFA, and finds abuse of identity pools. | low to high |
| Planned, not in the release yet |
V-020a Identity pool abuse slice | Finds identity pool accounts created by hand, pools listed at volume, sign-ups at volume and settings changed outside the pipeline. | low to high |
| In the current release |
Frontend assets
| Rule | What it checks | Severity | Techniques | Shipped in |
|---|---|---|---|---|
V-037 Frontend asset integrity | Finds writes to CDN origin buckets by principals other than CI, distribution and edge function changes, and missing origin access control. | high to critical | none listed | Planned, not in the release yet |
Lane rules
These read events as they arrive and raise a finding within the event lane. They catch the attempt as well as the success where a sentence says so.
| Rule | What it checks | Severity | Techniques | Shipped in |
|---|---|---|---|---|
LR-01 | Catches anyone stopping or changing a trail, a detector, a config recorder or flow logs, even when the attempt is refused. | critical | none listed | In the current release |
LR-02 | Catches any touch of one of your decoys, even when the attempt is refused. | critical | none listed | In the current release |
LR-03 | Catches a principal creating an access key or console password for another user, and every console password change. | high | none listed | In the current release |
LR-04 | Catches one line of identities creating three or more users, roles, keys or console passwords within 10 minutes. | critical | none listed | In the current release |
LR-05 | Catches administrator rights being granted, and role trust being opened to an account outside your accounts. | high | none listed | In the current release |
LR-06 | Catches snapshots and images shared outward, buckets opened to the public and function URLs with no authentication. | high | none listed | In the current release |
LR-07 | Catches GPU instances launched, more than 20 instances by one principal, or launches in three or more regions within 10 minutes. | high | none listed | In the current release |
LR-08 | Catches root activity, console sign-ins without MFA and bursts of failed console sign-ins. | high | none listed | In the current release |
LR-09 | Catches one session calling in six or more regions within 5 minutes. | medium | none listed | In the current release |
LR-10 | Catches one principal making 40 or more distinct read calls within 10 minutes. | medium | none listed | In the current release |
LR-11 | Catches any write on a Warden resource by a principal that is not Warden's, even when the attempt is refused. | critical | none listed | In the current release |
LR-12 | Catches a write by a principal on its first ever call from a network. | medium | none listed | In the current release |
LR-13 | Catches model invocation logging being changed, model access being opened and a principal's first model use. | medium to critical | none listed | In the current release |
Rule packs
No rule pack has been published yet. When one is, it appears here with the rules it adds and a changelog in plain words: what it adds, what it changes and what it retires.
Read the security model for what a finding can and cannot do, or compare Warden with other tools by property.