Detect Cloud Secrets Management Stores in Google Chronicle

rule t1555_006_cloud_secrets_excessive_access {
  meta:
    author = "Detection Engineering"
    description = "Detects excessive access to cloud secrets management APIs across AWS Secrets Manager, Azure Key Vault, and GCP Secret Manager within a one-hour window, consistent with bulk credential harvesting by threat actors including HAFNIUM, Storm-0501, and Scattered Spider."
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1555.006"
    severity = "HIGH"
    confidence = "MEDIUM"
    reference = "https://attack.mitre.org/techniques/T1555/006/"
    created = "2025-01-01"
    version = "1.0"

  events:
    (
      (
        $e.metadata.vendor_name = "Amazon Web Services" and
        $e.metadata.product_event_type in (
          "GetSecretValue",
          "ListSecrets",
          "DescribeSecret",
          "BatchGetSecretValue"
        )
      ) or
      (
        $e.metadata.vendor_name = "Microsoft Azure" and
        $e.metadata.product_event_type in (
          "SecretGet",
          "SecretList",
          "VaultGet"
        )
      ) or
      (
        $e.metadata.vendor_name = "Google Cloud Platform" and
        re.regex(
          $e.metadata.product_event_type,
          `google\.cloud\.secretmanager\.v1\.SecretManagerService\.(AccessSecretVersion|ListSecrets)`
        )
      )
    )
    $user = $e.principal.user.userid
    $ip = $e.principal.ip

  match:
    $user, $ip over 1h

  condition:
    #e > 10
}