Anomalous Batch Retrieval of AWS Secrets

This threat brief focuses on the detection of anomalous activity within AWS Secrets Manager, specifically the rapid execution of the BatchGetSecretValue API. While this API is designed for efficient retrieval of multiple secrets, an excessive volume of successful requests by a single principal within a short window (defined as more than 10 requests within one hour) often serves as a precursor or evidence of credential harvesting. Attackers who have gained initial access to a cloud environment may attempt to dump credentials, API keys, or database passwords to further their movement, facilitate lateral movement, or achieve persistence. Defenders must distinguish this malicious bulk extraction from legitimate automated processes like credential-rotation services or application initialization scripts to effectively mitigate the risk of account takeover.

Attack Chain

1. Initial access is gained to an AWS environment, likely through compromised IAM credentials or an insecure EC2 instance profile.
2. The attacker identifies the presence of AWS Secrets Manager within the account infrastructure.
3. The attacker determines the scope of available secrets by enumerating existing secrets.
4. Using the identified identity, the attacker initiates BatchGetSecretValue requests to the AWS Secrets Manager service.
5. The attacker executes multiple calls to the API within a one-hour timeframe to bypass standard single-secret request limitations.
6. The exfiltrated sensitive data is used to authenticate to external services, databases, or further internal systems.
7. The attacker uses the harvested secrets to escalate privileges or establish persistence, leading to full account takeover or data exfiltration.

Impact

Successful exploitation of this technique leads to the unauthorized extraction of highly sensitive information, including database credentials, API keys, and configuration secrets. This exposure frequently results in complete account takeover, significant data exfiltration, or the further compromise of secondary cloud and on-premises resources. The number of impacted secrets can be vast, as BatchGetSecretValue enables rapid extraction, limiting the time for defensive intervention.

Recommendation

Prioritize the investigation of high-volume BatchGetSecretValue activity identified by the analytic provided in this brief.

• Enable AWS CloudTrail management event logging and ensure BatchGetSecretValue is included in the captured dataset.
• Baseline the activity of known automated systems (e.g., CI/CD pipelines, secret rotators) that legitimately trigger BatchGetSecretValue to reduce false positives.
• Investigate all alerts by reviewing the associated user_arn, sourceIPAddress, and userAgent in CloudTrail logs to confirm authorization.
• Implement IAM policies that adhere to the principle of least privilege, restricting access to secretsmanager:BatchGetSecretValue only to principals that explicitly require it.
• If a suspicious identity is identified, immediately audit the secret identifiers retrieved and consider rotating the exposed credentials.