Detection rules › Panther
AWS Secrets Manager Retrieve Secrets Multi-Region
An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets. This rule identifies BatchGetSecretValue events for multiple regions in a short period of time.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1552 Unsecured Credentials |
Rules detecting the same action
Other rules on this platform that filter on the same API call or operation.
Rule body yaml
AnalysisType: rule
Filename: aws_secretsmanager_retrieve_secrets_multiregion.py
RuleID: "AWS.SecretsManager.RetrieveSecretsMultiRegion"
DisplayName: "AWS Secrets Manager Retrieve Secrets Multi-Region"
Enabled: true
LogTypes:
- AWS.CloudTrail
Tags:
- AWS
- Credential Access
- Stratus Red Team
Reports:
MITRE ATT&CK:
- TA0006:T1552 # Credentials from Password Stores
Severity: Info
Description: >
An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023).
An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.
This rule identifies BatchGetSecretValue events for multiple regions in a short period of time.
Runbook: https://aws.amazon.com/blogs/security/how-to-use-the-batchgetsecretsvalue-api-to-improve-your-client-side-applications-with-aws-secrets-manager/
Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets/
Threshold: 5
DedupPeriodMinutes: 10
SummaryAttributes:
- eventName
- userAgent
- sourceIpAddress
- recipientAccountId
- p_any_aws_arns
Tests:
- Name: BatchGetSecretValue in us-east-1
ExpectedResult: true
Log: {
"eventSource": "secretsmanager.amazonaws.com",
"eventName": "BatchGetSecretValue",
"awsRegion": "us-east-1",
"requestParameters": {
"filters": [
{
"key": "tag-key",
"values": [
"!tagKeyThatWillNeverExist"
]
}
]
},
"responseElements": null,
"readOnly": true,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "012345678901"
}
- Name: Non-batch GetSecretValue event - no match
ExpectedResult: false
Log: {
"eventSource": "secretsmanager.amazonaws.com",
"eventName": "GetSecretValue",
"awsRegion": "us-east-1",
"recipientAccountId": "012345678901"
}
Detection logic
Condition
eventName eq "BatchGetSecretValue"
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
eventName | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
eventName |
eventSource |
awsRegion |
recipientAccountId |
sourceIPAddress |
userAgent |
userIdentity |
actor_user |