detection.wiki

Detection rules › Panther

AWS Secrets Manager Batch Retrieve Secrets Catch-All

Status
Experimental
Severity
informational
Log types
AWS.CloudTrail
Tags
AWS, Credential Access, Stratus Red Team
Reference
https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets/
Source
github.com/panther-labs/panther-analysis

An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets. Although BatchGetSecretValue requires a list of secret IDs or a filter, an attacker may use a catch-all filter to retrieve all secrets by batch. This rule identifies BatchGetSecretValue events with a catch-all filter.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1552 Unsecured Credentials

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

AnalysisType: rule
Filename: aws_secretsmanager_retrieve_secrets_catchall.py
RuleID: "AWS.SecretsManager.BatchRetrieveSecretsCatchAll"
DisplayName: "AWS Secrets Manager Batch Retrieve Secrets Catch-All"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Credential Access
  - Stratus Red Team
Status: Experimental
Reports:
  MITRE ATT&CK:
    - TA0006:T1552 # Credentials from Password Stores 
Severity: Info
Description: >
  An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). 
  An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.
  Although BatchGetSecretValue requires a list of secret IDs or a filter, an attacker may use a catch-all filter to retrieve all secrets by batch.
  This rule identifies BatchGetSecretValue events with a catch-all filter.
Runbook: https://aws.amazon.com/blogs/security/how-to-use-the-batchgetsecretsvalue-api-to-improve-your-client-side-applications-with-aws-secrets-manager/
Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets/
Threshold: 1
DedupPeriodMinutes: 1440
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: BatchGetSecretValue Catch-All
    ExpectedResult: true
    Log: {
      "eventSource": "secretsmanager.amazonaws.com",
      "eventName": "BatchGetSecretValue",
      "requestParameters": {
        "filters": [
          {
            "key": "tag-key",
            "values": [
              "!tagKeyThatWillNeverExist"
            ]
          }
        ]
      },
      "responseElements": null,
      "readOnly": true,
      "eventType": "AwsApiCall",
      "managementEvent": true,
      "recipientAccountId": "012345678901"
    }
  - Name: BatchGetSecretValue Catch-All with other filters
    ExpectedResult: false
    Log: {
      "eventSource": "secretsmanager.amazonaws.com",
      "eventName": "BatchGetSecretValue",
      "requestParameters": {
        "filters": [
          {
            "key": "tag-key",
            "values": [
              "!tagKeyThatWillNeverExist"
            ]
          },
          {
            "key": "tag-key",
            "values": [
              "tagThatExists"
            ]
          }
        ]
      },
      "responseElements": null,
      "readOnly": true,
      "eventType": "AwsApiCall",
      "managementEvent": true,
      "recipientAccountId": "012345678901"
    }

Detection logic

Condition

eventName eq "BatchGetSecretValue"

This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
eventNameeq
  • BatchGetSecretValue

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
eventName
eventSource
awsRegion
recipientAccountId
sourceIPAddress
userAgent
userIdentity
actor_user