Name:AWS Anomalous Secrets Manager Batch Retrieval id:93646bda-291b-4a59-a926-19f08e26f7cd version:1 date:None author:Maria Jose Erquiaga, Splunk status:production type:TTP Description:The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour. It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity. Data_source:
| where isnotnull(user_arn) AND isnotnull(vendor_account) AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")
| eval event_key=coalesce(eventID, md5(_raw))
| dedup event_key
| eval event_time=_time
| sort 0 + _time
| streamstats time_window=1h count AS rolling_batch_request_count min(event_time) AS window_start BY vendor_account user_arn
| eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end BY vendor_account user_arn
| eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start BY vendor_account user_arn
| where isnotnull(qualifying_start) AND event_time>=qualifying_start AND event_time<=qualifying_end
| stats count AS batch_request_count values(sourceIPAddress) AS src values(userAgent) AS user_agent values(awsRegion) AS vendor_region earliest(event_time) AS firstTime latest(event_time) AS lastTime
how_to_implement:Ingest AWS CloudTrail management events into Splunk using the aws:cloudtrail sourcetype. known_false_positives:Legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use BatchGetSecretValue for the first time.
A principal may trigger the detection again when it has not used the API during the preceding seven days.
Review the principal, source IP address, user agent, account, region, requested secret identifiers, and surrounding CloudTrail activity to determine whether the request was authorized. References: -https://attack.mitre.org/techniques/T1555/006/ -https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html -https://docs.aws.amazon.com/secretsmanager/latest/userguide/cloudtrail_log_entries.html -https://www.elastic.co/guide/en/security/8.19/aws-secrets-manager-rapid-secrets-retrieval.html drilldown_searches: name:'View detection results for - "$user_arn$"' search:'%original_detection_search% | search user_arn="$user_arn$" vendor_account="$vendor_account$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View Secrets Manager activity for the last 7 days for - "$user_arn$"' search:'`cloudtrail` eventSource="secretsmanager.amazonaws.com" | eval user_arn='userIdentity.arn', vendor_account=recipientAccountId | where (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") | search user_arn="$user_arn$" vendor_account="$vendor_account$" | table _time user_arn vendor_account eventName sourceIPAddress userAgent awsRegion requestParameters' earliest_offset:'7d' latest_offset:'0' name:'View risk events for the last 7 days for - "$user_arn$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object="$user_arn$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['AWS Identity and Access Management Account Takeover']
