Loading

Multiple Cloud Secrets Accessed by Source Address

This rule detects authenticated sessions accessing secret stores across multiple cloud providers from the same source address within a short period of time. Adversaries with access to compromised credentials or session tokens may attempt to retrieve secrets from services such as AWS Secrets Manager, Google Secret Manager, or Azure Key Vault in rapid succession to expand their access or exfiltrate sensitive information.

Rule type: esql
Rule indices:

Rule Severity: high
Risk Score: 73
Runs every: 5m
Searches indices from: now-9m
Maximum alerts per execution: ?
References:

Tags:

  • Domain: Cloud
  • Domain: IAM
  • Domain: Storage
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Data Source: AWS Secrets Manager
  • Data Source: Azure
  • Data Source: Azure Activity Logs
  • Data Source: GCP
  • Data Source: Google Cloud Platform
  • Tactic: Credential Access
  • Resources: Investigation Guide

Version: ?
Rule authors:

  • Elastic

Rule license: Elastic License v2
This multi-datasource rule relies on additional configurations from each hyperscaler.

This alert identifies a single source IP address accessing secret-management APIs across multiple cloud providers (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault) within a short timeframe. This behavior is strongly associated with credential theft, session hijacking, or token replay, where an adversary uses stolen authenticated sessions to harvest secrets across cloud environments.

Unexpected cross-cloud secret retrieval is uncommon and typically indicates automation misuse or malicious activity.

  • Validate the principal
    • Identify the user, service account, workload identity, or application making the requests.
    • Confirm whether this identity is expected to operate across more than one cloud provider.
  • Review related activity
    • Look for additional alerts involving the same identity, source IP, or token over the last 24–48 hours.
    • Identify whether the source IP has been observed performing unusual authentication, privilege escalation, or reconnaissance.
  • Check application or service context
    • Determine whether any workload legitimately pulls secrets from multiple cloud providers.
    • Review deployment pipelines or integration layers that might legitimately bridge AWS, Azure, and GCP.
  • Analyze user agent and invocation patterns
    • Compare user_agent.original or equivalent fields against expected SDKs or automation tools.
    • Suspicious indicators include CLI tools, unknown libraries, browser user agents, or custom scripts.
  • Inspect IP reputation and origin
    • Determine whether the source IP corresponds to a managed workload (EC2, GCE, Azure VM) or an unexpected host.
    • Validate that the associated instance or host is under your control and behaving normally.
  • Review IAM permissions and accessed secrets
    • Check the policies attached to the identity.
    • Verify whether the accessed secrets are sensitive, unused, or unrelated to the identity’s purpose.
  • Assess potential compromise scope
    • If compromise is suspected, enumerate other assets accessed by the same identity in the last 24 hours.
    • Look for lateral movement, privilege escalation, or abnormal API usage.
  • Validate whether the source IP is associated with a legitimate multi-cloud orchestration tool, automation pipeline, or shared CI/CD system.
  • Confirm that the identity is authorized to access secrets across multiple cloud services.
  • If activity is expected, consider adding exceptions that pair account identity, source IP, and expected user agent to reduce noise.
  • Initiate incident response** if the activity is unauthorized or suspicious.
  • Restrict or disable** the affected credentials or service accounts.
  • Rotate all accessed secrets** and review other secrets the identity can access.
  • Analyze systems** that may have leaked credentials, such as compromised hosts or exposed tokens.
  • Harden identity security:
    • Enforce MFA for users where applicable.
    • Reduce permissions to least privilege.
    • Review trust relationships, workload identities, and cross-cloud integrations.
  • Search for persistence mechanisms** such as newly created keys, roles, or service accounts.
  • Improve monitoring and audit visibility** by ensuring logging is enabled across all cloud environments.
  • Determine root cause** (phishing, malware, token replay, exposed credential, etc.) and close the vector to prevent recurrence.
FROM logs-azure.platformlogs-*, logs-azure.activitylogs-*, logs-aws.cloudtrail-*, logs-gcp.audit-* METADATA _id, _version, _index
| WHERE
  (
    /* AWS Secrets Manager */
    (event.dataset == "aws.cloudtrail" AND event.provider == "secretsmanager.amazonaws.com" AND event.action == "GetSecretValue") OR
    // Azure Key Vault (platform logs)
    (event.dataset == "azure.platformlogs" AND event.action IN ("SecretGet", "KeyGet")) or
    /* Azure Key Vault (activity logs) */
    (event.dataset == "azure.activitylogs" AND azure.activitylogs.operation_name IN ("MICROSOFT.KEYVAULT/VAULTS/SECRETS/LIST", "MICROSOFT.KEYVAULT/VAULTS/SECRETS/GET")) OR
    /* Azure Managed HSM secret */
    (event.dataset == "azure.activitylogs" AND azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*") OR
    /* Google Secret Manager */
    (event.dataset IN ("googlecloud.audit", "gcp.audit") AND
     event.action IN ("google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion", "google.cloud.secretmanager.v1.SecretManagerService.GetSecretRequest"))
   ) AND source.ip IS NOT NULL
// Unified user identity (raw)
| EVAL Esql_priv.user_id =
    COALESCE(
      client.user.id,
      aws.cloudtrail.user_identity.arn,
      azure.platformlogs.identity.claim.upn,
      NULL
    )
// Cloud vendor label based on dataset
| EVAL Esql.cloud_vendor = CASE(
    event.dataset == "aws.cloudtrail", "aws",
    event.dataset IN ("azure.platformlogs","azure.activitylogs"), "azure",
    event.dataset IN ("googlecloud.audit","gcp.audit"), "gcp",
    "unknown"
  )
// Vendor+tenant label, e.g. aws:123456789012, azure:tenant, gcp:project
| EVAL Esql.tenant_label = CASE(
    Esql.cloud_vendor == "aws", CONCAT("aws:", cloud.account.id),
    Esql.cloud_vendor == "azure", CONCAT("azure:", cloud.account.id),
    Esql.cloud_vendor == "gcp", CONCAT("gcp:", cloud.account.id),
    NULL
  )
| STATS
    // Core counts
    Esql.events_count = COUNT(*),
    Esql.vendor_count_distinct = COUNT_DISTINCT(Esql.cloud_vendor),
    // Action & data source context
    Esql.event_action_values = VALUES(event.action),
    Esql.data_source_values = VALUES(event.dataset),
    // Cloud vendor + tenant context
    Esql.cloud_vendor_values = VALUES(Esql.cloud_vendor),
    Esql.tenant_label_values = VALUES(Esql.tenant_label),
    // Hyperscaler-specific IDs
    Esql.aws_account_id_values = VALUES(CASE(Esql.cloud_vendor == "aws", cloud.account.id, NULL)),
    Esql.azure_tenant_id_values = VALUES(CASE(Esql.cloud_vendor == "azure", cloud.account.id, NULL)),
    Esql.gcp_project_id_values = VALUES(CASE(Esql.cloud_vendor == "gcp", cloud.account.id, NULL)),
    // Generic cloud metadata
    Esql.cloud_region_values = VALUES(cloud.region),
    Esql.cloud_service_name_values = VALUES(cloud.service.name),
    // Identity (privileged)
    Esql_priv.user_values = VALUES(Esql_priv.user_id),
    Esql_priv.client_user_id_values = VALUES(client.user.id),
    Esql_priv.aws_user_identity_arn_values = VALUES(aws.cloudtrail.user_identity.arn),
    Esql_priv.azure_upn_values = VALUES(azure.platformlogs.identity.claim.upn),
    // Namespace values
    Esql.data_stream_namespace_values = VALUES(data_stream.namespace)
  BY source.ip
// Require multi-vendor cred-access from same source IP
| WHERE Esql.vendor_count_distinct >= 2
| SORT Esql.events_count DESC
| KEEP Esql.*, Esql_priv.*, source.ip

Framework: MITRE ATT&CK