Applied Cybernetics Group
T1555.006 Cloud Secrets Management Stores
- Technique
T1555.006- Tactics
- Credential Access
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 0
- Elastic, Splunk
- 11
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1555/006
MITRE description
Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables. If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure.(Citation: Permiso Scattered Spider 2023)(Citation: Sysdig ScarletEel 2.0 2023)(Citation: AWS Secrets Manager)(Citation: Google Cloud Secrets)(Citation: Microsoft Azure Key Vault) **Note:** this technique is distinct from [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005) in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-21Microsoft Threat Intelligence: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Detection coverage
Elastic and Splunk rules
- Multiple Cloud Secrets Accessed by Source Address (elastic)
- First Time Seen AWS Secret Value Accessed in Secrets Manager (elastic)
- AWS Secrets Manager Rapid Secrets Retrieval (elastic)
- AWS Systems Manager SecureString Parameter Request with Decryption Flag (elastic)
- AWS Lateral Movement from Kubernetes SA via AssumeRoleWithWebIdentity (elastic)
- Microsoft Foundry Keys or Connection Secrets Accessed by New Principal (elastic)
- Azure Storage Account Keys Accessed by Privileged User (elastic)
- Azure Key Vault Excessive Secret or Key Retrieved (elastic)
- Azure Key Vault Unusual Secret Key Usage (elastic)
- Azure Key Vault Multi-Vault Secret Retrieval Burst by Application (elastic)
- AWS Anomalous Secrets Manager Batch Retrieval (splunk)