legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use batchgetsecretvalue for the first time. a principal may trigger the detection again when it has not used the api during the preceding seven days. review the principal, source ip address, user agent, account, region, requested secret identifiers, and surrounding cloudtrail activity to determine whether the request was authorized.

splunk

Techniques

Sample rules

AWS Anomalous Secrets Manager Batch Retrieval

source: splunk
technicques:

Description

The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour. It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.

Detection logic

`cloudtrail`
eventName="BatchGetSecretValue"
eventSource="secretsmanager.amazonaws.com"


| eval user_arn='userIdentity.arn',
       vendor_account=recipientAccountId


| where isnotnull(user_arn) AND isnotnull(vendor_account)
    AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")


| eval event_key=coalesce(eventID, md5(_raw))


| dedup event_key


| eval event_time=_time


| sort 0 + _time


| streamstats time_window=1h count AS rolling_batch_request_count
    min(event_time) AS window_start
    BY vendor_account user_arn


| eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end
    BY vendor_account user_arn


| eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start
    BY vendor_account user_arn


| where isnotnull(qualifying_start)
        AND event_time>=qualifying_start
        AND event_time<=qualifying_end


| stats count AS batch_request_count
        values(sourceIPAddress) AS src
        values(userAgent) AS user_agent
        values(awsRegion) AS vendor_region
        earliest(event_time) AS firstTime
        latest(event_time) AS lastTime

  BY vendor_account user_arn


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `aws_anomalous_secrets_manager_batch_retrieval_filter`