Skip to content

Add AWS Secrets Manager batch retrieval attack data - #1229

Merged
nasbench merged 1 commit into
masterfrom
dataset/aws-anomalous-secrets-manager-batch-retrieval
Sep 30, 2026
Merged

nasbench merged 1 commit into
masterfrom
dataset/aws-anomalous-secrets-manager-batch-retrieval

Conversation

@themaryjo

Copy link
Copy Markdown
Contributor

Summary

Adds anonymized AWS CloudTrail events generated by a successful AWS Secrets Manager BatchGetSecretValue request.

Dataset

  • Event name: BatchGetSecretValue
  • Event source: secretsmanager.amazonaws.com
  • MITRE ATT&CK: T1555.006 — Cloud Secrets Management Stores
  • Source: aws_cloudtrail
  • Sourcetype: aws:cloudtrail

Anonymization

Sensitive account, access-key, identity, network, region, and secret identifier values were replaced with synthetic values.

Related detection

This dataset supports the AWS Anomalous Secrets Manager Batch Retrieval detection in the security_content draft pull request.

@github-actions

Copy link
Copy Markdown

✅ Attack Data Validation Passed

All YAML files in this PR have been successfully validated against the schema.

Ready for review and merge! 🚀

@themaryjo
themaryjo marked this pull request as ready for review September 29, 2026 16:32
@nasbench
nasbench merged commit d192cc5 into master Sep 30, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants