Retrieve a High Number of Secrets Manager secrets (Batch)

idempotent

Platform: AWS

MITRE ATT&CK Tactics

• Credential Access

Description

Retrieves a high number of Secrets Manager secrets by batch, through secretsmanager:BatchGetSecretValue (released Novemeber 2023). An attacker may attempt to retrieve a high number of secrets by batch, to avoid detection and generate fewer calls. Note that the batch size is limited to 20 secrets.

Warm-up:

• Create multiple secrets in Secrets Manager.

Detonation:

• Dump all secrets by batch of 10, using secretsmanager:BatchGetSecretValue.

References:

• https://aws.amazon.com/blogs/security/how-to-use-the-batchgetsecretsvalue-api-to-improve-your-client-side-applications-with-aws-secrets-manager/

Instructions

Detonate with Stratus Red Team

stratus detonate aws.credential-access.secretsmanager-batch-retrieve-secrets

Detection

Identify principals that attempt to retrieve secrets by batch, through CloudTrail's BatchGetSecretValue event. Sample event:

{
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "BatchGetSecretValue",
  "requestParameters": {
    "filters": [
      {
        "key": "tag-key",
        "values": [
          "StratusRedTeam"
        ]
      }
    ]
  },
  "responseElements": null,
  "readOnly": true,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "012345678901"
}

Although BatchGetSecretValue requires a list of secret IDs or a filter, an attacker may use a catch-all filter to retrieve all secrets by batch:

{
  "eventSource": "secretsmanager.amazonaws.com",
  "eventName": "BatchGetSecretValue",
  "requestParameters": {
    "filters": [
      {
        "key": "tag-key",
        "values": [
          "!tagKeyThatWillNeverExist"
        ]
      }
    ]
  },
  "responseElements": null,
  "readOnly": true,
  "eventType": "AwsApiCall",
  "managementEvent": true,
  "recipientAccountId": "012345678901"
}

The following may be use to tune the detection, or validate findings:

• Principals who do not usually call GetBatchSecretValue
• Attempts to call GetBatchSecretValue resulting in access denied errors
• Principals calling GetBatchSecretValue in several regions in a short period of time