-
Detects a single identity listing Google Cloud Secret Manager secrets across many distinct projects in a short window. ListSecrets does not return secret values, but sweeping many projects is a common reconnaissance step before targeted AccessSecretVersion calls. Legitimate workloads typically list secrets within one project or a small set of projects; cross-project bursts from one user and source IP are uncommon outside security tooling or compromise.
Read More -
Multiple Cloud Secrets Accessed by Source Address
Sep 19, 2026 · Domain: Cloud Domain: IAM Domain: Storage Data Source: AWS Data Source: Amazon Web Services Data Source: AWS Secrets Manager Data Source: Azure Data Source: Azure Activity Logs Data Source: GCP Data Source: Google Cloud Platform Data Source: Kubernetes Tactic: Credential Access Resources: Investigation Guide Noise: Low Performance: Fast Profile: Recommended Rule Type: ES|QL Platform: AWS Platform: Azure Platform: Kubernetes Platform: GCP Domain: Containers Domain: Identity Service: AWS Secrets Manager Data Source: Azure Platform Logs Service: Azure Key Vault Service: GCP Secret Manager ·This rule detects authenticated sessions accessing secret stores across multiple environments from the same source address within a short period of time, including cloud providers (AWS, GCP, Azure) and Kubernetes clusters. Adversaries with access to compromised credentials or session tokens may attempt to retrieve secrets from services such as AWS Secrets Manager, Google Secret Manager, Azure Key Vault, or Kubernetes Secrets in rapid succession to expand their access or exfiltrate sensitive information.
Read More