AWS Secrets Manager Batch Retrieve Secrets Catch-All

AnalysisType: rule
Filename: aws_secretsmanager_retrieve_secrets_catchall.py
RuleID: "AWS.SecretsManager.BatchRetrieveSecretsCatchAll"
DisplayName: "AWS Secrets Manager Batch Retrieve Secrets Catch-All"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Credential Access
  - Stratus Red Team
Status: Experimental
Reports:
  MITRE ATT&CK:
    - TA0006:T1552 # Credentials from Password Stores 
Severity: Info
Description: >
  An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). 
  An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.
  Although BatchGetSecretValue requires a list of secret IDs or a filter, an attacker may use a catch-all filter to retrieve all secrets by batch.
  This rule identifies BatchGetSecretValue events with a catch-all filter.
Runbook: https://aws.amazon.com/blogs/security/how-to-use-the-batchgetsecretsvalue-api-to-improve-your-client-side-applications-with-aws-secrets-manager/
Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets/
Threshold: 1
DedupPeriodMinutes: 1440
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: BatchGetSecretValue Catch-All
    ExpectedResult: true
    Log: {
      "eventSource": "secretsmanager.amazonaws.com",
      "eventName": "BatchGetSecretValue",
      "requestParameters": {
        "filters": [
          {
            "key": "tag-key",
            "values": [
              "!tagKeyThatWillNeverExist"
            ]
          }
        ]
      },
      "responseElements": null,
      "readOnly": true,
      "eventType": "AwsApiCall",
      "managementEvent": true,
      "recipientAccountId": "012345678901"
    }
  - Name: BatchGetSecretValue Catch-All with other filters
    ExpectedResult: false
    Log: {
      "eventSource": "secretsmanager.amazonaws.com",
      "eventName": "BatchGetSecretValue",
      "requestParameters": {
        "filters": [
          {
            "key": "tag-key",
            "values": [
              "!tagKeyThatWillNeverExist"
            ]
          },
          {
            "key": "tag-key",
            "values": [
              "tagThatExists"
            ]
          }
        ]
      },
      "responseElements": null,
      "readOnly": true,
      "eventType": "AwsApiCall",
      "managementEvent": true,
      "recipientAccountId": "012345678901"
    }

# ------ paired body: aws_secretsmanager_retrieve_secrets_catchall.py ------

from panther_aws_helpers import aws_rule_context


def rule(event):
    if event.get("eventName") != "BatchGetSecretValue":
        return False

    filters = event.deep_get("requestParameters", "filters", default=[])
    for filt in filters:
        if filt.get("key") != "tag-key":
            return False
        if any(not value.startswith("!") for value in filt.get("values")):
            return False

    return True


def title(event):
    user = event.udm("actor_user")
    return (
        f"[{user}] attempted to batch retrieve secrets from "
        "AWS Secrets Manager with a catch-all filter"
    )


def alert_context(event):
    return aws_rule_context(event)