Analytics BIOC
Informational
✕
AWS Secrets Manager discovery
An attempt was made to list secrets from AWS Secrets Manager.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Credential Access (TA0006) Discovery (TA0007)
ATT&CK techniques: Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006) Cloud Service Discovery (T1526)
Attacker's goals:
Exfiltrate sensitive secrets stored in AWS Secrets Manager.
Investigative actions:
Check if the secrets manager activity aligns with known workflows or automation, or if it indicates abnormal activity. Follow further actions done by the identity.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
1 variation:
- Unusual AWS Secrets Manager discovery Informational