AWS SSM parameters discovery

Analytics BIOC Informational

AWS SSM parameters discovery

An attempt was made to list parameters stored in AWS SSM.

Module:: Cortex Cloud
Licensed by:: Cloud Runtime Security (CRS)
Data source:: AWS Audit Log

ATT&CK tactics: Credential Access (TA0006) Discovery (TA0007)

ATT&CK techniques: Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006) Cloud Service Discovery (T1526)

Detector tags: SSM Remote Management Analytics

Attacker's goals:

Exfiltrate sensitive secrets stored in SSM parameter store.

Investigative actions:

Check if the secrets manager activity aligns with known workflows or automation, or if it indicates abnormal activity. Follow further actions done by the identity.

Test period:: N/A (single event)
Deduplication:: 5 Days

1 variation:

Unusual AWS SSM parameters discovery Informational