Detect Cloud Secrets Management Stores in IBM QRadar
Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material. If an adversary gains sufficient privileges in a cloud environment, they may request secrets via API calls such as get-secret-value (AWS), gcloud secrets describe (GCP), and az key vault secret show (Azure). This technique has been used by HAFNIUM, Storm-0501, Scattered Spider, and ScarletEel.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1555 Credentials from Password Stores
- Sub-technique
- T1555.006 Cloud Secrets Management Stores
- Canonical reference
- https://attack.mitre.org/techniques/T1555/006/
QRadar Detection Query
SELECT
username,
sourceip,
CASE
WHEN LOGSOURCETYPENAME(devicetype) LIKE '%CloudTrail%' THEN 'AWS'
WHEN LOGSOURCETYPENAME(devicetype) LIKE '%Azure%' OR LOGSOURCETYPENAME(devicetype) LIKE '%Microsoft%' THEN 'Azure'
WHEN LOGSOURCETYPENAME(devicetype) LIKE '%Google%' OR LOGSOURCETYPENAME(devicetype) LIKE '%GCP%' THEN 'GCP'
ELSE 'Unknown'
END AS cloud_provider,
COUNT(*) AS SecretAccessCount,
COUNT(DISTINCT QIDNAME(qid)) AS UniqueOperationTypes,
DATEFORMAT(MIN(starttime), 'yyyy-MM-dd HH:mm:ss') AS FirstAccess,
DATEFORMAT(MAX(starttime), 'yyyy-MM-dd HH:mm:ss') AS LastAccess
FROM events
WHERE
(
(
LOGSOURCETYPENAME(devicetype) LIKE '%CloudTrail%'
AND QIDNAME(qid) IN ('GetSecretValue', 'ListSecrets', 'DescribeSecret', 'BatchGetSecretValue')
)
OR (
(LOGSOURCETYPENAME(devicetype) LIKE '%Azure%' OR LOGSOURCETYPENAME(devicetype) LIKE '%Microsoft%')
AND (
LOWER(QIDNAME(qid)) LIKE '%secretget%'
OR LOWER(QIDNAME(qid)) LIKE '%keyvault%'
OR LOWER(QIDNAME(qid)) LIKE '%secretlist%'
)
)
OR (
(LOGSOURCETYPENAME(devicetype) LIKE '%Google%' OR LOGSOURCETYPENAME(devicetype) LIKE '%GCP%')
AND (
QIDNAME(qid) LIKE '%AccessSecretVersion%'
OR QIDNAME(qid) LIKE '%ListSecrets%'
)
)
)
GROUP BY username, sourceip, cloud_provider
HAVING COUNT(*) > 10
ORDER BY SecretAccessCount DESC
LAST 24 HOURSAQL query against the QRadar normalised events store that aggregates secrets management API operations from AWS CloudTrail, Azure Activity, and GCP Audit log source types over the trailing 24 hours. Groups by username and source IP to identify principals exceeding 10 qualifying events — a threshold indicative of automated credential harvesting rather than interactive use. UniqueOperationTypes provides secondary signal for breadth of access.
Data Sources
Required Tables
False Positives & Tuning
- Cloud infrastructure monitoring and CSPM agents (Datadog, Orca, Wiz) that periodically enumerate secrets metadata across all vaults for inventory and misconfiguration scanning — identifiable by consistent scheduling and dedicated service account usernames
- DevOps toolchains using shared service accounts to resolve secrets during large-scale deployment pipelines spanning dozens of microservices — count spikes correlated with deployment pipeline timing
- Secrets management middleware with caching disabled (AWS SDK without TTL, HashiCorp Vault Agent in legacy mode) that fetches the same secret on every application request — high frequency from a static IP with a single secret name pattern
Other platforms for T1555.006
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate AWS Secrets Manager secrets
Expected signal: AWS CloudTrail: ListSecrets event followed by GetSecretValue event, both with the caller's IAM identity ARN and source IP. Events appear in CloudTrail within 5-15 minutes.
- Test 2Retrieve Azure Key Vault secret
Expected signal: Azure Key Vault diagnostic logs: SecretList and SecretGet operations with caller IP and identity. Azure AD audit log entry for the service principal or user identity.
- Test 3Access GCP Secret Manager secret
Expected signal: GCP Cloud Audit Log: Admin Activity log for ListSecrets, Data Access log for AccessSecretVersion. Both events contain the principal email and source IP.
References (7)
- https://attack.mitre.org/techniques/T1555/006/
- https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html
- https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-cli
- https://cloud.google.com/secret-manager/docs/view-secret-details
- https://sysdig.com/blog/scarleteel-2-0/
- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1555.006/T1555.006.md
Unlock Pro Content
Get the full detection package for T1555.006 including response playbook, investigation guide, and atomic red team tests.