Add AWS CloudTrail behavioral detections

detections/cloud/aws_anomalous_secrets_manager_batch_retrieval.yml

@@ -0,0 +1,99 @@
+name: AWS Anomalous Secrets Manager Batch Retrieval
+id: 93646bda-291b-4a59-a926-19f08e26f7cd
+version: 1
+creation_date: '2026-09-29'
+modification_date: '2026-09-29'
+author: Maria Jose Erquiaga, Splunk
+status: production
+type: TTP
+description: >-
+    The following analytic detects an AWS principal making more than 10
+    distinct successful Secrets Manager BatchGetSecretValue API calls within
+    one hour. It groups calls by AWS account and user identity ARN and
+    deduplicates CloudTrail events by event ID. Repeated batch retrieval may
+    indicate bulk access to secrets using a compromised identity, although
+    legitimate automation can produce similar activity.
+data_source:
+    - AWS CloudTrail
+search: |-
+    `cloudtrail` eventName="BatchGetSecretValue" eventSource="secretsmanager.amazonaws.com"
+    | eval user_arn='userIdentity.arn', vendor_account=recipientAccountId
+    | where isnotnull(user_arn) AND isnotnull(vendor_account)
+        AND (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success")
+    | eval event_key=coalesce(eventID, md5(_raw))
+    | dedup event_key
+    | eval event_time=_time
+    | sort 0 + _time
+    | streamstats time_window=1h count AS rolling_batch_request_count
+        min(event_time) AS window_start
+        BY vendor_account user_arn
+    | eventstats max(eval(if(rolling_batch_request_count>10, event_time, null()))) AS qualifying_end
+        BY vendor_account user_arn
+    | eventstats min(eval(if(event_time=qualifying_end, window_start, null()))) AS qualifying_start
+        BY vendor_account user_arn
+    | where isnotnull(qualifying_start)
+        AND event_time>=qualifying_start
+        AND event_time<=qualifying_end
+    | stats count AS batch_request_count
+        values(sourceIPAddress) AS src
+        values(userAgent) AS user_agent
+        values(awsRegion) AS vendor_region
+        earliest(event_time) AS firstTime
+        latest(event_time) AS lastTime
+        BY vendor_account user_arn
+    | `security_content_ctime(firstTime)`
+    | `security_content_ctime(lastTime)`
+    | `aws_anomalous_secrets_manager_batch_retrieval_filter`
+how_to_implement: >-
+    Ingest AWS CloudTrail management events into Splunk using the
+    aws:cloudtrail sourcetype.
+known_false_positives: Legitimate administrators, deployment systems, credential-rotation services, incident-response tooling, or newly deployed applications may use BatchGetSecretValue for the first time. A principal may trigger the detection again when it has not used the API during the preceding seven days. Review the principal, source IP address, user agent, account, region, requested secret identifiers, and surrounding CloudTrail activity to determine whether the request was authorized.
+references:
+    - https://attack.mitre.org/techniques/T1555/006/
+    - https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html
+    - https://docs.aws.amazon.com/secretsmanager/latest/userguide/cloudtrail_log_entries.html
+    - https://www.elastic.co/guide/en/security/8.19/aws-secrets-manager-rapid-secrets-retrieval.html
+drilldown_searches:
+    - name: View detection results for - "$user_arn$"
+      search: '%original_detection_search% | search user_arn="$user_arn$" vendor_account="$vendor_account$"'
+      earliest_offset: $info_min_time$
+      latest_offset: $info_max_time$
+    - name: View Secrets Manager activity for the last 7 days for - "$user_arn$"
+      search: '`cloudtrail` eventSource="secretsmanager.amazonaws.com" | eval user_arn=''userIdentity.arn'', vendor_account=recipientAccountId | where (isnull(errorCode) OR errorCode="" OR lower(errorCode)="success") | search user_arn="$user_arn$" vendor_account="$vendor_account$" | table _time user_arn vendor_account eventName sourceIPAddress userAgent awsRegion requestParameters'
+      earliest_offset: 7d
+      latest_offset: "0"
+    - name: View risk events for the last 7 days for - "$user_arn$"
+      search: '| from datamodel Risk.All_Risk | search normalized_risk_object="$user_arn$" | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
+      earliest_offset: 7d
+      latest_offset: "0"
+finding:
+    title: Identity $user_arn$ made $batch_request_count$ successful AWS Secrets Manager BatchGetSecretValue requests within one hour
+    entity:
+        field: user_arn
+        type: user
+        score: 40
+threat_objects:
+    - field: src
+      type: ip_address
+analytic_story:
+    - AWS Identity and Access Management Account Takeover
+asset_type: AWS Account
+mitre_attack_id:
+    - T1555.006
+product:
+    - Splunk Cloud
+    - Splunk Enterprise
+    - Splunk Enterprise Security
+category: cloud
+security_domain: threat
+tests:
+    - name: True Positive Test
+      attack_data:
+        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555.006/aws_anomalous_secrets_manager_batch_retrieval/aws_anomalous_secrets_manager_batch_retrieval.json
+          source: aws_cloudtrail
+          sourcetype: aws:cloudtrail
+      description: >-
+        Verifies that the analytic detects more than 10 successful
+        BatchGetSecretValue API calls by the same principal in the same AWS
+        account within a rolling one-hour window.
+      test_type: experimental