AWS Secrets Manager Batch Retrieve Secrets

AnalysisType: rule
Filename: aws_secretsmanager_retrieve_secrets_batch.py
RuleID: "AWS.SecretsManager.BatchRetrieveSecrets"
DisplayName: "AWS Secrets Manager Batch Retrieve Secrets"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Credential Access
  - Stratus Red Team
Status: Experimental
Reports:
  MITRE ATT&CK:
    - TA0006:T1552 # Credentials from Password Stores 
  Stratus Red Team:
    - aws.credential-access.secretsmanager-batch-retrieve-secrets
Severity: Info
Description: >
  An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). 
  An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.
Runbook: https://aws.amazon.com/blogs/security/how-to-use-the-batchgetsecretsvalue-api-to-improve-your-client-side-applications-with-aws-secrets-manager/
Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets/
Threshold: 5
DedupPeriodMinutes: 1440
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: BatchGetSecretValue
    ExpectedResult: true
    Log: {
      "eventSource": "secretsmanager.amazonaws.com",
      "eventName": "BatchGetSecretValue",
      "requestParameters": {
        "filters": [
          {
            "key": "tag-key",
            "values": [
              "StratusRedTeam"
            ]
          }
        ]
      },
      "responseElements": null,
      "readOnly": true,
      "eventType": "AwsApiCall",
      "managementEvent": true,
      "recipientAccountId": "012345678901"
    }

# ------ paired body: aws_secretsmanager_retrieve_secrets_batch.py ------

from panther_aws_helpers import aws_rule_context


def rule(event):
    if event.get("eventName") == "BatchGetSecretValue":
        return True
    return False


def title(event):
    user = event.udm("actor_user")
    return (
        f"[{user}] attempted to batch retrieve a large number of secrets from AWS Secrets Manager"
    )


def alert_context(event):
    return aws_rule_context(event)