Analytics
Low
✕
An identity successfully extracted multiple secrets within the organization
An identity successfully dumped multiple secrets from the project. This may indicate an attacker's attempt to dump sensitive information from the cloud environment.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006)
Attacker's goals:
Collect secrets from the cloud environment.
Investigative actions:
Check the accessed secrets' designation. Verify that the identity did not dump any sensitive information that it shouldn't.
- Test period:
- 1 Hour
- Deduplication:
- 5 Days
2 variations:
- An identity successfully enumerated and extracted multiple secrets within the organization Medium (parent: Low)
- An identity successfully extracted multiple secrets within the organization across multiple regions Medium (parent: Low)