Cloud Secrets Management Stores

let AWSSecretOps = dynamic(["GetSecretValue", "ListSecrets", "DescribeSecret", "BatchGetSecretValue"]);
let AzureSecretOps = dynamic(["SecretGet", "SecretList", "Microsoft.KeyVault/vaults/secrets/read", "Microsoft.KeyVault/vaults/secrets/getSecret"]);
let GCPSecretOps = dynamic(["google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion", "google.cloud.secretmanager.v1.SecretManagerService.ListSecrets"]);
CloudAppEvents
| where Timestamp > ago(24h)
| where ActionType has_any (AWSSecretOps) or ActionType has_any (AzureSecretOps) or ActionType has_any (GCPSecretOps)
| summarize SecretAccessCount=count(), UniqueSecrets=dcount(tostring(RawEventData.requestParameters.secretId)),
            FirstAccess=min(Timestamp), LastAccess=max(Timestamp)
            by AccountDisplayName, IPAddress, Application
| where SecretAccessCount > 10 or UniqueSecrets > 5
| sort by SecretAccessCount desc

(index=aws sourcetype="aws:cloudtrail" eventName IN ("GetSecretValue", "ListSecrets", "DescribeSecret", "BatchGetSecretValue"))
OR (index=azure sourcetype="azure:audit" operationName="*KeyVault*" operationName IN ("SecretGet", "SecretList", "VaultGet"))
OR (index=gcp sourcetype="google:gcp:pubsub:message" data.protoPayload.methodName="google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion")
| eval cloud_provider=case(
    sourcetype=="aws:cloudtrail", "AWS",
    sourcetype=="azure:audit", "Azure",
    sourcetype=="google:gcp:pubsub:message", "GCP",
    1=1, "Unknown")
| eval identity=coalesce(userIdentity.arn, claims.upn, data.protoPayload.authenticationInfo.principalEmail)
| eval source_ip=coalesce(sourceIPAddress, callerIpAddress, data.protoPayload.requestMetadata.callerIp)
| eval secret_name=coalesce(requestParameters.secretId, properties.id, data.protoPayload.resourceName)
| stats count as SecretAccessCount, dc(secret_name) as UniqueSecrets, earliest(_time) as FirstAccess, latest(_time) as LastAccess by identity, source_ip, cloud_provider
| where SecretAccessCount > 10 OR UniqueSecrets > 5
| sort - SecretAccessCount

sequence by user.name, source.ip with maxspan=1h
  [any where event.dataset in ("aws.cloudtrail", "azure.activitylogs", "gcp.audit")
   and (
     event.action in ("GetSecretValue", "ListSecrets", "DescribeSecret", "BatchGetSecretValue",
                      "SecretGet", "SecretList", "VaultGet")
     or event.action : ("*AccessSecretVersion*", "*SecretManagerService*")
   )
  ] with runs=10

SELECT
  username,
  sourceip,
  CASE
    WHEN LOGSOURCETYPENAME(devicetype) LIKE '%CloudTrail%' THEN 'AWS'
    WHEN LOGSOURCETYPENAME(devicetype) LIKE '%Azure%' OR LOGSOURCETYPENAME(devicetype) LIKE '%Microsoft%' THEN 'Azure'
    WHEN LOGSOURCETYPENAME(devicetype) LIKE '%Google%' OR LOGSOURCETYPENAME(devicetype) LIKE '%GCP%' THEN 'GCP'
    ELSE 'Unknown'
  END AS cloud_provider,
  COUNT(*) AS SecretAccessCount,
  COUNT(DISTINCT QIDNAME(qid)) AS UniqueOperationTypes,
  DATEFORMAT(MIN(starttime), 'yyyy-MM-dd HH:mm:ss') AS FirstAccess,
  DATEFORMAT(MAX(starttime), 'yyyy-MM-dd HH:mm:ss') AS LastAccess
FROM events
WHERE
  (
    (
      LOGSOURCETYPENAME(devicetype) LIKE '%CloudTrail%'
      AND QIDNAME(qid) IN ('GetSecretValue', 'ListSecrets', 'DescribeSecret', 'BatchGetSecretValue')
    )
    OR (
      (LOGSOURCETYPENAME(devicetype) LIKE '%Azure%' OR LOGSOURCETYPENAME(devicetype) LIKE '%Microsoft%')
      AND (
        LOWER(QIDNAME(qid)) LIKE '%secretget%'
        OR LOWER(QIDNAME(qid)) LIKE '%keyvault%'
        OR LOWER(QIDNAME(qid)) LIKE '%secretlist%'
      )
    )
    OR (
      (LOGSOURCETYPENAME(devicetype) LIKE '%Google%' OR LOGSOURCETYPENAME(devicetype) LIKE '%GCP%')
      AND (
        QIDNAME(qid) LIKE '%AccessSecretVersion%'
        OR QIDNAME(qid) LIKE '%ListSecrets%'
      )
    )
  )
GROUP BY username, sourceip, cloud_provider
HAVING COUNT(*) > 10
ORDER BY SecretAccessCount DESC
LAST 24 HOURS

(_sourceCategory=aws/cloudtrail OR _sourceCategory=azure/audit OR _sourceCategory=gcp/audit) earliest=-24h
| json auto
| where eventName in ("GetSecretValue","ListSecrets","DescribeSecret","BatchGetSecretValue")
  OR operationName matches "*KeyVault*Secret*"
  OR methodName matches "*AccessSecretVersion*"
| if (eventName in ("GetSecretValue","ListSecrets","DescribeSecret","BatchGetSecretValue"), "AWS",
    if (operationName matches "*KeyVault*", "Azure", "GCP")) as cloud_provider
| count(*) as SecretAccessCount, count_distinct(requestParameters_secretId) as UniqueSecrets
    by userIdentity_arn, sourceIPAddress, cloud_provider
| where SecretAccessCount > 10 or UniqueSecrets > 5
| sort by SecretAccessCount desc

rule t1555_006_cloud_secrets_excessive_access {
  meta:
    author = "Detection Engineering"
    description = "Detects excessive access to cloud secrets management APIs across AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager within a one-hour window, consistent with bulk credential harvesting by threat actors including HAFNIUM, Storm-0501, and Scattered Spider."
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1555.006"
    severity = "HIGH"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1555/006/"
    created = "2025-01-01"
    version = "1.0"

  events:
    (
      (
        $e.metadata.vendor_name = "Amazon Web Services" and
        $e.metadata.product_event_type in (
          "GetSecretValue",
          "ListSecrets",
          "DescribeSecret",
          "BatchGetSecretValue"
        )
      ) or
      (
        $e.metadata.vendor_name = "Microsoft Azure" and
        $e.metadata.product_event_type in (
          "SecretGet",
          "SecretList",
          "VaultGet"
        )
      ) or
      (
        $e.metadata.vendor_name = "Google Cloud Platform" and
        re.regex(
          $e.metadata.product_event_type,
          `google\.cloud\.secretmanager\.v1\.SecretManagerService\.(AccessSecretVersion|ListSecrets)`
        )
      )
    )
    $user = $e.principal.user.userid
    $ip = $e.principal.ip

  match:
    $user, $ip over 1h

  condition:
    #e > 10
}

#repo=cloud_audit
(
  EventName in ["GetSecretValue", "ListSecrets", "DescribeSecret", "BatchGetSecretValue"]
  OR operationName = /KeyVault.*Secret|SecretGet|SecretList/i
  OR protoPayload.methodName = /AccessSecretVersion|SecretManagerService.*ListSecrets/
)
| cloud_provider := case {
    test(EventName) | "AWS";
    test(operationName) | "Azure";
    * | "GCP"
  }
| identity := coalesce(
    userIdentity.arn,
    claims.upn,
    protoPayload.authenticationInfo.principalEmail,
    "unknown"
  )
| source_ip := coalesce(
    sourceIPAddress,
    callerIpAddress,
    protoPayload.requestMetadata.callerIp,
    "unknown"
  )
| secret_name := coalesce(
    requestParameters.secretId,
    resourceName,
    properties.id,
    "unknown"
  )
| groupBy(
    [identity, source_ip, cloud_provider],
    function=[
      count(as=SecretAccessCount),
      count(secret_name, distinct=true, as=UniqueSecrets),
      min(@timestamp, as=FirstAccess),
      max(@timestamp, as=LastAccess)
    ]
  )
| where SecretAccessCount > 10 OR UniqueSecrets > 5
| sort(SecretAccessCount, order=desc)