Techniques › T1555.006 › AN0366
AN0366 Analytic 0366
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of suspicious access to cloud-native secret management systems (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault). Focuses on abnormal secret retrieval activity, such as secrets being accessed by unusual identities, from unexpected regions, outside business hours, or at high volume. Correlates API calls to secret retrieval with surrounding authentication events, role assumptions, and anomalous execution patterns.</p>
- Detects
- T1555.006 Cloud Secrets Management Stores
- Part of
- DET0130 Detect Unauthorized Access to Cloud Secrets Management Stores
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | GetSecretValue | DC0083 Cloud Service Enumeration |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
PrivilegedRoles | Set of accounts or roles allowed to retrieve secrets; deviations may indicate misuse. |
TimeWindow | Temporal window to correlate secret access with authentication and anomalous context. |
AccessPatterns | Expected frequency and volume of secret retrievals per user/service; anomalies may indicate exfiltration. |
RegionConstraints | Regions in which secret access is expected; access from unusual geographies may indicate compromise. |