Analytics BIOC Informational

AWS SSM parameters retrieval

An attempt was made to retrieve parameters stored in AWS SSM.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006)
Detector tags: SSM Remote Management Analytics
Attacker's goals:

Exfiltrate sensitive secrets stored in AWS SSM parameter store.

Investigative actions:

Investigate the purpose of the encrypted parameter and assess the sensitivity of its contents. Check if the access aligns with known workflows or automation, or if it indicates abnormal activity.

Test period:
N/A (single event)
Deduplication:
1 Day
1 variation:
  • AWS SSM encrypted parameters retrieval Informational