AWS Secrets Manager Retrieve Secrets Multi-Region

AnalysisType: rule
Filename: aws_secretsmanager_retrieve_secrets_multiregion.py
RuleID: "AWS.SecretsManager.RetrieveSecretsMultiRegion"
DisplayName: "AWS Secrets Manager Retrieve Secrets Multi-Region"
Enabled: true
LogTypes:
  - AWS.CloudTrail
Tags:
  - AWS
  - Credential Access
  - Stratus Red Team
Reports:
  MITRE ATT&CK:
    - TA0006:T1552 # Credentials from Password Stores 
Severity: Info
Description: >
  An attacker attempted to retrieve a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). 
  An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.
  This rule identifies BatchGetSecretValue events for multiple regions in a short period of time.
Runbook: https://aws.amazon.com/blogs/security/how-to-use-the-batchgetsecretsvalue-api-to-improve-your-client-side-applications-with-aws-secrets-manager/
Reference: https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets/
Threshold: 5
DedupPeriodMinutes: 10
SummaryAttributes:
  - eventName
  - userAgent
  - sourceIpAddress
  - recipientAccountId
  - p_any_aws_arns
Tests:
  - Name: BatchGetSecretValue in us-east-1
    ExpectedResult: true
    Log: {
      "eventSource": "secretsmanager.amazonaws.com",
      "eventName": "BatchGetSecretValue",
      "awsRegion": "us-east-1",
      "requestParameters": {
        "filters": [
          {
            "key": "tag-key",
            "values": [
              "!tagKeyThatWillNeverExist"
            ]
          }
        ]
      },
      "responseElements": null,
      "readOnly": true,
      "eventType": "AwsApiCall",
      "managementEvent": true,
      "recipientAccountId": "012345678901"
    }
  - Name: Non-batch GetSecretValue event - no match
    ExpectedResult: false
    Log: {
      "eventSource": "secretsmanager.amazonaws.com",
      "eventName": "GetSecretValue",
      "awsRegion": "us-east-1",
      "recipientAccountId": "012345678901"
    }

# ------ paired body: aws_secretsmanager_retrieve_secrets_multiregion.py ------

from panther_aws_helpers import aws_rule_context


def rule(event):
    return event.get("eventName") == "BatchGetSecretValue"


def unique(event):
    return event.get("awsRegion", "")


def title(event):
    user = event.udm("actor_user")
    return f"[{user}] attempted to retrieve secrets from AWS Secrets Manager in multiple regions"


def alert_context(event):
    return aws_rule_context(event)