Techniques
Sample rules
GCP Secret Manager ListSecrets Across Multiple Projects
- source: elastic
- technicques:
- T1526
Description
Detects a single identity listing Google Cloud Secret Manager secrets across many distinct projects in a short window. ListSecrets does not return secret values, but sweeping many projects is a common reconnaissance step before targeted AccessSecretVersion calls. Legitimate workloads typically list secrets within one project or a small set of projects; cross-project bursts from one user and source IP are uncommon outside security tooling or compromise.
Detection logic
from logs-gcp.audit-* metadata _id, _version, _index
| where data_stream.dataset == "gcp.audit"
and event.action == "google.cloud.secretmanager.v1.SecretManagerService.ListSecrets"
and cloud.project.id is not null
and client.user.email is not null
and source.ip is not null
| stats
Esql.cloud_project_id_count_distinct = count_distinct(cloud.project.id),
Esql.cloud_project_id_values = values(cloud.project.id),
Esql.event_count = count(*),
Esql.event_outcome_values = values(event.outcome),
Esql.client_user_id_values = values(client.user.id),
Esql.user_agent_original_values = values(user_agent.original),
Esql.earliest_timestamp = min(@timestamp),
Esql.latest_timestamp = max(@timestamp)
by client.user.email, source.ip, data_stream.namespace
| where Esql.cloud_project_id_count_distinct >= 10
| keep
client.user.email,
source.ip,
Esql.cloud_project_id_count_distinct,
Esql.cloud_project_id_values,
Esql.event_count,
Esql.event_outcome_values,
Esql.client_user_id_values,
Esql.user_agent_original_values,
Esql.earliest_timestamp,
Esql.latest_timestamp,
data_stream.namespace