Detection: AWS Anomalous Secrets Manager Batch Retrieval

Created: 2026-09-29 Last Updated: 2026-09-29 ID: 93646bda-291b-4a59-a926-19f08e26f7cd Author: Maria Jose Erquiaga, Splunk Type: TTP Product: Splunk Enterprise Security

Description

The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within one hour. It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID. Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.

Search

 1`cloudtrail`
 2eventName="BatchGetSecretValue"
 3eventSource="secretsmanager.amazonaws.com"
 4
 5
 6| eval user_arn='userIdentity.arn',
 7       vendor_account=recipientAccountId
 8
 9
10| where isnotnull(user_arn) AND isnotnull(vendor_account)
11    AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")
12
13
14| eval event_key=coalesce(eventID, md5(_raw))
15
16
17| dedup event_key
18
19
20| eval event_time=_time
21
22
23| sort 0 + _time
24
25
26| streamstats time_window=1h count AS rolling_batch_request_count
27    min(event_time) AS window_start
28    BY vendor_account user_arn
29
30
31| eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end
32    BY vendor_account user_arn
33
34
35| eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start
36    BY vendor_account user_arn
37
38
39| where isnotnull(qualifying_start)
40        AND event_time>=qualifying_start
41        AND event_time<=qualifying_end
42
43
44| stats count AS batch_request_count
45        values(sourceIPAddress) AS src
46        values(userAgent) AS user_agent
47        values(awsRegion) AS vendor_region
48        earliest(event_time) AS firstTime
49        latest(event_time) AS lastTime
50
51  BY vendor_account user_arn
52
53
54| `security_content_ctime(firstTime)`
55
56| `security_content_ctime(lastTime)`
57
58| `aws_anomalous_secrets_manager_batch_retrieval_filter`

Data Source

Name	Platform	Sourcetype	Source
AWS CloudTrail	AWS	`'aws:cloudtrail'`	`'aws_cloudtrail'`

Macros Used

Name	Value
security_content_ctime	`convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)`
aws_anomalous_secrets_manager_batch_retrieval_filter	`search *`

aws_anomalous_secrets_manager_batch_retrieval_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1555.006	Cloud Secrets Management Stores	Credential Access

Exploitation

DE.CM

CIS 10

Storm-0501

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	Yes
Rule Title	`%name%`
Rule Description	`%description%`
Notable Event Fields	user, dest
Creates Intermediate Finding (Risk Event)	No

TTP detections generate a Finding (Notable) and may generate Intermediate Findings (Risk Events) for associated entities.

Implementation

Ingest AWS CloudTrail management events into Splunk using the aws:cloudtrail sourcetype.

Known False Positives

Legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use BatchGetSecretValue for the first time. A principal may trigger the detection again when it has not used the API during the preceding seven days. Review the principal, source IP address, user agent, account, region, requested secret identifiers, and surrounding CloudTrail activity to determine whether the request was authorized.

Associated Analytic Story

AWS Identity and Access Management Account Takeover

Finding

Title	Entity Field	Entity Type	Risk Score
The identity [$user_arn$] made [$batch_request_count$] successful AWS Secrets Manager BatchGetSecretValue requests within one hour	user_arn	user	40

Threat Objects

Field	Type
src	ip_address

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`aws_cloudtrail`	`aws:cloudtrail`
Integration	✅ Passing	Dataset	`aws_cloudtrail`	`aws:cloudtrail`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1