[New] Multiple Cloud Secrets Accessed by Source Address

This rule detects authenticated sessions accessing secret stores across multiple cloud providers from the same source
address within a short period of time. Adversaries with access to compromised credentials or session tokens may attempt
to retrieve secrets from services such as AWS Secrets Manager, Google Secret Manager, or Azure Key Vault in rapid
succession to expand their access or exfiltrate sensitive information.

Author: Samirbous

rules/cross-platform/credential_access_multi_could_secrets_via_api.toml

@@ -0,0 +1,160 @@
+[metadata]
+creation_date = "2025/12/01"
+integration = ["aws", "gcp", "azure"]
+maturity = "production"
+updated_date = "2025/12/01"
+
+[rule]
+author = ["Elastic"]
+description = """
+This rule detects authenticated sessions accessing secret stores across multiple cloud providers from the same source
+address within a short period of time. Adversaries with access to compromised credentials or session tokens may attempt
+to retrieve secrets from services such as AWS Secrets Manager, Google Secret Manager, or Azure Key Vault in rapid
+succession to expand their access or exfiltrate sensitive information.
+"""
+from = "now-9m"
+interval = "1m"
+language = "esql"
+license = "Elastic License v2"
+name = "Multiple Cloud Secrets Accessed by Source Address"
+note = """## Triage and analysis
+
+### Multiple Cloud Secrets Accessed by Source Address
+
+This alert identifies a single source IP address accessing secret-management APIs across **multiple cloud providers**
+(e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault) within a short timeframe.
+This behavior is strongly associated with **credential theft, session hijacking, or token replay**, where an adversary
+uses stolen authenticated sessions to harvest secrets across cloud environments.
+
+Unexpected cross-cloud secret retrieval is uncommon and typically indicates automation misuse or malicious activity.
+
+### Possible investigation steps
+
+- Validate the principal
+  - Identify the user, service account, workload identity, or application making the requests.
+  - Confirm whether this identity is expected to operate across more than one cloud provider.
+- Review related activity
+  - Look for additional alerts involving the same identity, source IP, or token over the last 24–48 hours.
+  - Identify whether the source IP has been observed performing unusual authentication, privilege escalation,
+    or reconnaissance.
+- Check application or service context
+  - Determine whether any workload legitimately pulls secrets from multiple cloud providers.
+  - Review deployment pipelines or integration layers that might legitimately bridge AWS, Azure, and GCP.
+- Analyze user agent and invocation patterns
+  - Compare `user_agent.original` or equivalent fields against expected SDKs or automation tools.
+  - Suspicious indicators include CLI tools, unknown libraries, browser user agents, or custom scripts.
+- Inspect IP reputation and origin
+  - Determine whether the source IP corresponds to a managed workload (EC2, GCE, Azure VM) or an unexpected host.
+  - Validate that the associated instance or host is under your control and behaving normally.
+- Review IAM permissions and accessed secrets
+  - Check the policies attached to the identity.
+  - Verify whether the accessed secrets are sensitive, unused, or unrelated to the identity’s purpose.
+- Assess potential compromise scope
+  - If compromise is suspected, enumerate other assets accessed by the same identity in the last 24 hours.
+  - Look for lateral movement, privilege escalation, or abnormal API usage.
+
+### False positive analysis
+
+- Validate whether the source IP is associated with a legitimate multi-cloud orchestration tool, automation pipeline,
+  or shared CI/CD system.
+- Confirm that the identity is authorized to access secrets across multiple cloud services.
+- If activity is expected, consider adding exceptions that pair account identity, source IP, and expected user agent
+  to reduce noise.
+
+### Response and remediation
+
+- Initiate incident response** if the activity is unauthorized or suspicious.
+- Restrict or disable** the affected credentials or service accounts.
+- Rotate all accessed secrets** and review other secrets the identity can access.
+- Analyze systems** that may have leaked credentials, such as compromised hosts or exposed tokens.
+- Harden identity security:
+  - Enforce MFA for users where applicable.
+  - Reduce permissions to least privilege.
+  - Review trust relationships, workload identities, and cross-cloud integrations.
+- Search for persistence mechanisms** such as newly created keys, roles, or service accounts.
+- Improve monitoring and audit visibility** by ensuring logging is enabled across all cloud environments.
+- Determine root cause** (phishing, malware, token replay, exposed credential, etc.) and close the vector to prevent recurrence.
+"""
+references = [
+    "https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_GetSecretValue.html",
+    "https://docs.cloud.google.com/secret-manager/docs/samples/secretmanager-access-secret-version",
+    "https://learn.microsoft.com/en-us/azure/key-vault/secrets/about-secrets",
+    "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack",
+]
+risk_score = 73
+rule_id = "472b4944-d810-43cf-83dc-7d080ae1b8dd"
+severity = "high"
+tags = [
+    "Domain: Cloud",
+    "Data Source: AWS",
+    "Data Source: Amazon Web Services",
+    "Data Source: AWS Secrets Manager",
+    "Data Source: Azure",
+    "Data Source: Azure Activity Logs",
+    "Data Source: GCP",
+    "Data Source: Google Cloud Platform",
+    "Tactic: Credential Access",
+    "Resources: Investigation Guide",
+]
+timestamp_override = "event.ingested"
+type = "esql"
+
+query = '''
+FROM logs-* metadata _id, _version, _index
+| WHERE
+ (
+    /* AWS Secrets Manager */
+    (event.dataset == "aws.cloudtrail"
+      AND event.provider == "secretsmanager.amazonaws.com"
+      AND event.action IN ("GetSecretValue", "BatchGetSecretValue"))
+
+    OR
+
+    /* Azure Key Vault (activity logs) */
+    (
+      event.dataset == "azure.activitylogs"
+      AND azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/VAULTS/SECRETS*"
+    ) or
+
+    /* Azure Managed HSM secret */
+    (
+     event.dataset == "azure.activitylogs" AND
+      azure.activitylogs.operation_name LIKE "MICROSOFT.KEYVAULT/managedHSM/keys/*")
+    )
+
+    OR
+
+    /* Google Secret Manager */
+    (
+      event.dataset IN ("googlecloud.audit", "gcp.audit")
+      AND event.action == "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion"
+    )
+ )
+ AND source.ip IS NOT NULL
+| STATS
+    Esql.dc_dataset = COUNT_DISTINCT(event.dataset),
+    Esql.event_action_values = VALUES(event.action),
+    Esql.users = VALUES(user.name)
+  BY source.ip
+| WHERE Esql.dc_dataset >= 2
+'''
+
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1555"
+name = "Credentials from Password Stores"
+reference = "https://attack.mitre.org/techniques/T1555/"
+[[rule.threat.technique.subtechnique]]
+id = "T1555.006"
+name = "Cloud Secrets Management Stores"
+reference = "https://attack.mitre.org/techniques/T1555/006/"
+
+
+
+[rule.threat.tactic]
+id = "TA0006"
+name = "Credential Access"
+reference = "https://attack.mitre.org/tactics/TA0006/"