Credentials from Password Stores: Cloud Secrets Management Stores `T1555.006`

Tactic: Credential Access

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

Authoring guide

These 8 rules share fields, values, and exclusions.

Fields filtered most (23 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	7	`in` 5, `eq` 4	`getsecretvalue`, `certificatecontactsget`, `certificateget`, `certificategetdeleted`, `assumerolewithwebidentity`
`data_stream.dataset`	7	`eq` 7, `in` 1	`aws.cloudtrail`, `azure.platformlogs`, `azure.activitylogs`, `gcp.audit`
`event.outcome`	5	`eq` 5	`success`
`Provider_Name`	3	`eq` 3	`secretsmanager.amazonaws.com`, `ssm.amazonaws.com`
`Esql.assume_count`	1	`ge` 1	`1`
`Esql.azure_platformlogs_identity_claim_upn_count_distinct`	1	`eq` 1	`1`
`Esql.cloud_vendor`	1	`ne` 1	`unknown`
`Esql.event_action_count_distinct`	1	`ge` 1	`2`
`Esql.event_count`	1	`ge` 1	`10`
`Esql.post_exploit_count`	1	`ge` 1	`3`
`Esql.vendor_count_distinct`	1	`ge` 1	`2`
`access_key`	1	`is_not_null` 1
`aws.cloudtrail.flattened.request_parameters.withDecryption`	1	`eq` 1	`true`
`aws::userIdentity.type`	1	`eq` 1	`assumedrole`
`azure.activitylogs.identity.authorization.evidence.principal_type`	1	`eq` 1	`user`

Top indicator values (81 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAWS Secrets Manager Rapid Secrets Retrieval elasticAWS Systems Manager SecureString Parameter Request with Decryption Flag elasticAzure Key Vault Unusual Secret Key Usage elasticAzure Storage Account Keys Accessed by Privileged User elasticFirst Time Seen AWS Secret Value Accessed in Secrets Manager	5	375
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Secrets Manager Rapid Secrets Retrieval elasticAWS Systems Manager SecureString Parameter Request with Decryption Flag elasticFirst Time Seen AWS Secret Value Accessed in Secrets Manager elasticMultiple Cloud Secrets Accessed by Source Address	4	173
`data_stream.dataset`	`eq`	`azure.platformlogs` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage elasticMultiple Cloud Secrets Accessed by Source Address	3	15
`EventType`	`eq`	`getsecretvalue` elasticAWS Secrets Manager Rapid Secrets Retrieval elasticFirst Time Seen AWS Secret Value Accessed in Secrets Manager elasticMultiple Cloud Secrets Accessed by Source Address	3	3
`EventType`	`in`	`keyget` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage elasticMultiple Cloud Secrets Accessed by Source Address	3	3
`EventType`	`in`	`secretget` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage elasticMultiple Cloud Secrets Accessed by Source Address	3	3
`EventType`	`in`	`certificatecontactsget` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`certificateget` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`certificategetdeleted` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`certificateissuerget` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`certificateissuerslist` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`certificatelist` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`certificatelistdeleted` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`certificatelistversions` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`certificatepolicyget` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`getparameters` elasticAWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity elasticAWS Systems Manager SecureString Parameter Request with Decryption Flag	2	2
`EventType`	`in`	`keygetdeleted` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`keylist` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`keylistdeleted` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`keylistversions` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`secretgetdeleted` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`secretlist` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`secretlistdeleted` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`secretlistversions` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`EventType`	`in`	`vaultget` elasticAzure Key Vault Excessive Secret or Key Retrieved elasticAzure Key Vault Unusual Secret Key Usage	2	2
`Provider_Name`	`eq`	`secretsmanager.amazonaws.com` elasticAWS Secrets Manager Rapid Secrets Retrieval elasticFirst Time Seen AWS Secret Value Accessed in Secrets Manager	2	2
`Esql.assume_count`	`ge`	`1` elasticAWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity	1
`Esql.azure_platformlogs_identity_claim_upn_count_distinct`	`eq`	`1` elasticAzure Key Vault Excessive Secret or Key Retrieved	1
`Esql.cloud_vendor`	`ne`	`unknown` elasticMultiple Cloud Secrets Accessed by Source Address	1
`Esql.event_action_count_distinct`	`ge`	`2` elasticAzure Key Vault Excessive Secret or Key Retrieved	1

Exclusions (13 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`fargate` elasticAWS Systems Manager SecureString Parameter Request with Decryption Flag elasticFirst Time Seen AWS Secret Value Accessed in Secrets Manager	2
`aws::userAgent`	`contains`	`terraform` elasticAWS Systems Manager SecureString Parameter Request with Decryption Flag	1
`aws::sourceIPAddress`	`in`	`apidestinations.events.amazonaws.com` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`aws::sourceIPAddress`	`in`	`cloudformation.amazonaws.com` elasticAWS Systems Manager SecureString Parameter Request with Decryption Flag	1
`aws::sourceIPAddress`	`in`	`kafka.amazonaws.com` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`aws::sourceIPAddress`	`in`	`servicecatalog.amazonaws.com` elasticAWS Systems Manager SecureString Parameter Request with Decryption Flag	1
`user.id`	`starts_with`	`AWSServiceRole` elasticFirst Time Seen AWS Secret Value Accessed in Secrets Manager	1
`user_agent.name`	`in`	`brave` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`chrome` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`edge` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`firefox` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`opera` elasticAWS Secrets Manager Rapid Secrets Retrieval	1
`user_agent.name`	`in`	`safari` elasticAWS Secrets Manager Rapid Secrets Retrieval	1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Cloud