From 0ab6ab191a79e518046f3a1f72018315480ecbf8 Mon Sep 17 00:00:00 2001 From: merquiag Date: Tue, 29 Sep 2026 16:54:39 +0200 Subject: [PATCH] Add AWS Secrets Manager batch retrieval attack data --- ...alous_secrets_manager_batch_retrieval.json | 3 +++ ...malous_secrets_manager_batch_retrieval.yml | 21 +++++++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json create mode 100644 datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.yml diff --git a/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json new file mode 100644 index 00000000..0b53328f --- /dev/null +++ b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:8291e7361c0132f7d4a79a4c697312cfa2e30ca3bae9baefc4166bcf605e1c63 +size 1523 diff --git a/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.yml b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.yml new file mode 100644 index 00000000..9797cc58 --- /dev/null +++ b/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.yml @@ -0,0 +1,21 @@ +author: Maria Jose Erquiaga +id: 58c8930b-66e5-4f65-826d-46a2136eeb76 +date: '2026-09-29' +description: >- + AWS CloudTrail events generated by an AWS identity making a successful + Secrets Manager BatchGetSecretValue API call. This API allows multiple + secret values to be retrieved in a single request and may be used by an + attacker with compromised AWS credentials to collect application + credentials, API tokens, database passwords, and other sensitive material + while generating fewer CloudTrail events than repeated GetSecretValue + requests. Sensitive account, access-key, identity, network, secret, and + region values were replaced with synthetic values. +environment: attack_range +directory: aws_anomalous_secrets_manager_batch_retrieval +mitre_technique: +- T1555.006 +datasets: +- name: aws_anomalous_secrets_manager_batch_retrieval-json + path: /datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail