Anvilogic high experimental other

EC2 secrets and parameters dumping [snowflake-awscloudtrail]

Enumerate secrets in AWS Secrets Manager and AWS Systems manager parameter store. Secrets Manager helps you improve the security posture of your organization. Secrets include database credentials, passwords, and third-party API keys. You can use Secrets Manager to store secrets centrally, encrypt secrets automatically, control access to secrets, and rotate secrets safely and automatically

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and identity_type = 'IAMUser' and event_type = 'AwsApiCall' and event_source = 'secretsmanager.amazonaws.com' and event_name = 'ListSecrets'

Field Validations

Loading…

Comments (0)

Loading comments...