Panther informational experimental python

AWS Secrets Manager Batch Retrieve Secrets

An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.

View Source

Detection Logic

from panther_aws_helpers import aws_rule_context


def rule(event):
    if event.get("eventName") == "BatchGetSecretValue":
        return True
    return False


def title(event):
    user = event.udm("actor_user")
    return (
        f"[{user}] attempted to batch retrieve a large number of secrets from AWS Secrets Manager"
    )


def alert_context(event):
    return aws_rule_context(event)

Field Validations

Loading…

Comments (0)

Loading comments...