AWS Credentials Used from GitHub Actions and Non-CI/CD Infrastructure

from logs-aws.cloudtrail-* metadata _id, _version, _index
| WHERE event.dataset == "aws.cloudtrail"
  
AND aws.cloudtrail.user_identity.access_key_id IS NOT NULL
  
AND @timestamp >= NOW() - 7 days
  
AND source.as.organization.name IS NOT NULL

// AWS API key used from github actions
| EVAL is_aws_github = user_agent.original LIKE "*aws-credentials-for-github-actions"

// non CI/CD related ASN
| EVAL is_not_cicd_infra = not source.as.organization.name IN ("Microsoft Corporation", "Amazon.com, Inc.", "Amazon Technologies Inc.", "Google LLC")
| STATS Esql.is_github_aws_key = MAX(CASE(is_aws_github, 1, 0)),
        Esql.has_suspicious_asn = MAX(CASE(is_not_cicd_infra, 1, 0)),
        Esql.last_seen_suspicious_asn = MAX(CASE(is_not_cicd_infra, @timestamp, NULL)),
        Esql.source_ip_values = VALUES(source.address), 
        Esql.source_asn_values = VALUES(source.as.organization.name) BY aws.cloudtrail.user_identity.access_key_id, user.name, cloud.account.id

// AWS API key tied to a GH action used from unusual ASN (non CI/CD infra)
| WHERE Esql.is_github_aws_key == 1 
AND  Esql.has_suspicious_asn == 1 

        // avoid alert duplicates within 1h interval
        
AND Esql.last_seen_suspicious_asn >= NOW() - 1 hour
| KEEP user.name, aws.cloudtrail.user_identity.access_key_id, Esql.*

False Positives

• ⚠ AWS credentials legitimately shared between GitHub Actions and another Microsoft/Azure service may trigger this rule. Verify whether the non-CI/CD source IP is expected for the workload.
• ⚠ GitHub Actions self-hosted runners running on non-Microsoft/Amazon/Google infrastructure will appear as suspicious. Add the ASN of your self-hosted runner infrastructure to the is_cicd_infra allowlist.