diff --git a/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml
new file mode 100644
index 0000000000..9243a8a30d
--- /dev/null
+++ b/detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml
@@ -0,0 +1,111 @@
+name: AWS Anomalous Secrets Manager Batch Retrieval
+id: 93646bda-291b-4a59-a926-19f08e26f7cd
+version: 1
+creation_date: '2026-09-29'
+modification_date: '2026-09-29'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: >-
+    The following analytic detects an AWS principal making more than 10 distinct successful Secrets Manager BatchGetSecretValue API calls within
+    one hour.
+    It groups calls by AWS account and user identity ARN and deduplicates CloudTrail events by event ID.
+    Repeated batch retrieval may indicate bulk access to secrets using a compromised identity, although legitimate automation can produce similar activity.
+data_source:
+    - AWS CloudTrail
+search: |-
+    `cloudtrail`
+    eventName="BatchGetSecretValue"
+    eventSource="secretsmanager.amazonaws.com"
+
+    | eval user_arn='userIdentity.arn',
+           vendor_account=recipientAccountId
+
+    | where isnotnull(user_arn) AND isnotnull(vendor_account)
+        AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")
+
+    | eval event_key=coalesce(eventID, md5(_raw))
+
+    | dedup event_key
+
+    | eval event_time=_time
+
+    | sort 0 + _time
+
+    | streamstats time_window=1h count AS rolling_batch_request_count
+        min(event_time) AS window_start
+        BY vendor_account user_arn
+
+    | eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end
+        BY vendor_account user_arn
+
+    | eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start
+        BY vendor_account user_arn
+
+    | where isnotnull(qualifying_start)
+            AND event_time>=qualifying_start
+            AND event_time<=qualifying_end
+
+    | stats count AS batch_request_count
+            values(sourceIPAddress) AS src
+            values(userAgent) AS user_agent
+            values(awsRegion) AS vendor_region
+            earliest(event_time) AS firstTime
+            latest(event_time) AS lastTime
+
+      BY vendor_account user_arn
+
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `aws_anomalous_secrets_manager_batch_retrieval_filter`
+how_to_implement: |-
+    Ingest AWS CloudTrail management events into Splunk using the aws:cloudtrail sourcetype.
+known_false_positives: |-
+    Legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use BatchGetSecretValue for the first time.
+    A principal may trigger the detection again when it has not used the API during the preceding seven days.
+    Review the principal, source IP address, user agent, account, region, requested secret identifiers, and surrounding CloudTrail activity to determine whether the request was authorized.
+references:
+    - https://attack.mitre.org/techniques/T1555/006/
+    - https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html
+    - https://docs.aws.amazon.com/secretsmanager/latest/userguide/cloudtrail_log_entries.html
+    - https://www.elastic.co/guide/en/security/8.19/aws-secrets-manager-rapid-secrets-retrieval.html
+drilldown_searches:
+    - name: View detection results for - "$user_arn$"
+      search: '%original_detection_search% | search user_arn="$user_arn$" vendor_account="$vendor_account$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View Secrets Manager activity for the last 7 days for - "$user_arn$"
+      search: '`cloudtrail` eventSource="secretsmanager.amazonaws.com" | eval user_arn=''userIdentity.arn'', vendor_account=recipientAccountId | where (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") | search user_arn="$user_arn$" vendor_account="$vendor_account$" | table _time user_arn vendor_account eventName sourceIPAddress userAgent awsRegion requestParameters'
+      earliest_offset: 7d
+      latest_offset: "0"
+    - name: View risk events for the last 7 days for - "$user_arn$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user_arn$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: The identity [$user_arn$] made [$batch_request_count$] successful AWS Secrets Manager BatchGetSecretValue requests within one hour
+    entity:
+        field: user_arn
+        type: user
+        score: 40
+threat_objects:
+    - field: src
+      type: ip_address
+analytic_story:
+    - AWS Identity and Access Management Account Takeover
+asset_type: AWS Account
+mitre_attack_id:
+    - T1555.006
+product:
+    - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+category: cloud
+security_domain: threat
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json
+          source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
+      test_type: unit