ATT&CK technique
View on MITRE ATT&CK →
T1555.006
Cloud Secrets Management Stores
Credential Access
10 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Microsoft Foundry Keys or Connection Secrets Accessed by New Principal | production | 2026-10-23 |
| splunk | AWS Anomalous Secrets Manager Batch Retrieval | production | 2026-09-29 |
| elastic | AWS Secrets Manager Rapid Secrets Retrieval | production | 2026-09-18 |
| elastic | AWS Systems Manager SecureString Parameter Request with Decryption Flag | production | 2026-09-18 |
| elastic | AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity | production | 2026-09-18 |
| elastic | Multiple Cloud Secrets Accessed by Source Address | production | 2026-09-18 |
| elastic | Azure Key Vault Excessive Secret or Key Retrieved | production | 2026-09-18 |
| elastic | Azure Key Vault Unusual Secret Key Usage | production | 2026-09-18 |
| elastic | Azure Storage Account Keys Accessed by Privileged User | production | 2026-09-18 |
| elastic | First Time Seen AWS Secret Value Accessed in Secrets Manager | production | 2026-09-18 |