diff --git a/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json
new file mode 100644
index 00000000..0b53328f
--- /dev/null
+++ b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8291e7361c0132f7d4a79a4c697312cfa2e30ca3bae9baefc4166bcf605e1c63
+size 1523
diff --git a/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.yml b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.yml
new file mode 100644
index 00000000..9797cc58
--- /dev/null
+++ b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.yml
@@ -0,0 +1,21 @@
+author: Maria Jose Erquiaga
+id: 58c8930b-66e5-4f65-826d-46a2136eeb76
+date: '2026-09-29'
+description: >-
+  AWS CloudTrail events generated by an AWS identity making a successful
+  Secrets Manager BatchGetSecretValue API call. This API allows multiple
+  secret values to be retrieved in a single request and may be used by an
+  attacker with compromised AWS credentials to collect application
+  credentials, API tokens, database passwords, and other sensitive material
+  while generating fewer CloudTrail events than repeated GetSecretValue
+  requests. Sensitive account, access-key, identity, network, secret, and
+  region values were replaced with synthetic values.
+environment: attack_range
+directory: aws_anomalous_secrets_manager_batch_retrieval
+mitre_technique:
+- T1555.006
+datasets:
+- name: aws_anomalous_secrets_manager_batch_retrieval-json
+  path: /datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json
+  sourcetype: aws:cloudtrail
+  source: aws_cloudtrail