Stolen Credential Detection
Detect stolen credentials that still work.
A stolen key or login passes every permission check, so Trailox alerts when it starts to read your data in a new way.
Trailox processes over 100 billion S3 requests per month across customers.
Stolen credential suspected
- Source IP
- External, first seen for this key
- Client
- aws-cli, first seen for this key
- Volume
- Far above this key's baseline
Next step: Disable the key, then use the same record to see what it read.
Client fingerprint changes
2 stack changes
| Identity | Change | Before → After | Detected | Risk score |
|---|---|---|---|---|
| prod-etl-workerStack change | Stack change | aws-sdk-go/1.51.3 changed to python-requests/2.31.0 | 3h ago | 9.6, high risk |
| legacy-backup-runnerStack change | Stack change | rclone/v1.64.2 changed to python-requests/2.31.0 | 5h ago | 7.2, medium risk |
| sso-administratoraccessRuntime change | Runtime change | aws-cli/2.17.4 Darwin changed to aws-cli/2.17.4 Windows | 9h ago | 3.4, low risk |
| kafka-connect-sink-7Client unnamed | Client unnamed | aws-sdk-java/2.25.11 changed to (none) | 2d ago | 3.3, low risk |
| user-reportgeneratorVersion downgrade | Version downgrade | aws-sdk-java/2.25.11 changed to aws-sdk-java/2.20.4 | 1d ago | 3.1, low risk |
- prod-etl-workerRisk9.6, high riskStack changeaws-sdk-go/1.51.3 changed to python-requests/2.31.0
- legacy-backup-runnerRisk7.2, medium riskStack changerclone/v1.64.2 changed to python-requests/2.31.0
- sso-administratoraccessRisk3.4, low riskRuntime changeaws-cli/2.17.4 Darwin changed to aws-cli/2.17.4 Windows
- kafka-connect-sink-7Risk3.3, low riskClient unnamedaws-sdk-java/2.25.11 changed to (none)
- user-reportgeneratorRisk3.1, low riskVersion downgradeaws-sdk-java/2.25.11 changed to aws-sdk-java/2.20.4
Start with a free
Data Access Review.
Read-only. First findings in 48 hours.