T1555.006 — Cloud Secrets Management Stores

Tactic: Credential Access · Platforms: IaaS

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets…

Sub-technique of Credentials from Password Stores (T1555).

Sigma detection rules (1)

T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores

title: "T1555.006 Credentials from Password Stores: Cloud Secrets Management Stores"
id: 1d0e89df-95ab-48a5-ba06-ff931ffefe3a
description: 'Detect Unauthorized Access to Cloud Secrets Management Stores. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PrivilegedRoles, TimeWindow, AccessPatterns, RegionConstraints.'
references:
  - https://attack.mitre.org/techniques/T1555/006
author: Shahrukh Khan
date: 2026-05-14
license: MIT
tags:
  - attack.credential-access
  - attack.t1555.006

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource:
      - 'secretsmanager.amazonaws.com'
      - 'ssm.amazonaws.com'
    eventName:
      - 'GetSecretValue'
      - 'GetParameter'
      - 'GetParameters'
      - 'GetParametersByPath'
  filter_undecrypted:
    requestParameters.withDecryption: false

  condition: selection and not filter_undecrypted

falsepositives:
  - Configuration management tools retrieving non-secret application parameters from SSM Parameter Store without decryption.

level: medium

Related sub-techniques

Explore