{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/t1555.006/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AWS Secrets Manager"],"_cs_severities":["medium"],"_cs_tags":["aws","cloud","credential-access","t1555.006"],"_cs_type":"advisory","_cs_vendors":["Amazon"],"content_html":"\u003cp\u003eThis threat brief focuses on the detection of anomalous activity within AWS Secrets Manager, specifically the rapid execution of the \u003ccode\u003eBatchGetSecretValue\u003c/code\u003e API. While this API is designed for efficient retrieval of multiple secrets, an excessive volume of successful requests by a single principal within a short window (defined as more than 10 requests within one hour) often serves as a precursor or evidence of credential harvesting. Attackers who have gained initial access to a cloud environment may attempt to dump credentials, API keys, or database passwords to further their movement, facilitate lateral movement, or achieve persistence. Defenders must distinguish this malicious bulk extraction from legitimate automated processes like credential-rotation services or application initialization scripts to effectively mitigate the risk of account takeover.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is gained to an AWS environment, likely through compromised IAM credentials or an insecure EC2 instance profile.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the presence of AWS Secrets Manager within the account infrastructure.\u003c/li\u003e\n\u003cli\u003eThe attacker determines the scope of available secrets by enumerating existing secrets.\u003c/li\u003e\n\u003cli\u003eUsing the identified identity, the attacker initiates \u003ccode\u003eBatchGetSecretValue\u003c/code\u003e requests to the AWS Secrets Manager service.\u003c/li\u003e\n\u003cli\u003eThe attacker executes multiple calls to the API within a one-hour timeframe to bypass standard single-secret request limitations.\u003c/li\u003e\n\u003cli\u003eThe exfiltrated sensitive data is used to authenticate to external services, databases, or further internal systems.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the harvested secrets to escalate privileges or establish persistence, leading to full account takeover or data exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this technique leads to the unauthorized extraction of highly sensitive information, including database credentials, API keys, and configuration secrets. This exposure frequently results in complete account takeover, significant data exfiltration, or the further compromise of secondary cloud and on-premises resources. The number of impacted secrets can be vast, as \u003ccode\u003eBatchGetSecretValue\u003c/code\u003e enables rapid extraction, limiting the time for defensive intervention.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the investigation of high-volume \u003ccode\u003eBatchGetSecretValue\u003c/code\u003e activity identified by the analytic provided in this brief.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEnable AWS CloudTrail management event logging and ensure \u003ccode\u003eBatchGetSecretValue\u003c/code\u003e is included in the captured dataset.\u003c/li\u003e\n\u003cli\u003eBaseline the activity of known automated systems (e.g., CI/CD pipelines, secret rotators) that legitimately trigger \u003ccode\u003eBatchGetSecretValue\u003c/code\u003e to reduce false positives.\u003c/li\u003e\n\u003cli\u003eInvestigate all alerts by reviewing the associated \u003ccode\u003euser_arn\u003c/code\u003e, \u003ccode\u003esourceIPAddress\u003c/code\u003e, and \u003ccode\u003euserAgent\u003c/code\u003e in CloudTrail logs to confirm authorization.\u003c/li\u003e\n\u003cli\u003eImplement IAM policies that adhere to the principle of least privilege, restricting access to \u003ccode\u003esecretsmanager:BatchGetSecretValue\u003c/code\u003e only to principals that explicitly require it.\u003c/li\u003e\n\u003cli\u003eIf a suspicious identity is identified, immediately audit the secret identifiers retrieved and consider rotating the exposed credentials.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T02:50:51Z","date_published":"2026-10-19T02:50:51Z","id":"https://feed.craftedsignal.io/briefs/2026-10-aws-anomalous-secrets-retrieval/","summary":"Detection of anomalous bulk retrieval of sensitive data from AWS Secrets Manager using the BatchGetSecretValue API, which may indicate unauthorized credential harvesting or account takeover.","title":"Anomalous Batch Retrieval of AWS Secrets","url":"https://feed.craftedsignal.io/briefs/2026-10-aws-anomalous-secrets-retrieval/"}],"language":"en","title":"CraftedSignal Threat Feed - T1555.006","version":"https://jsonfeed.org/version/1.1"}