Bulk AWS Secrets Manager enumeration and dump from single principal

Ibrahim Saud@tektrix

•updated Sep 24, 2026•1•0•1

Detects an identity that performs a 'ListSecrets' operation followed by a high volume of 'GetSecretValue' or 'BatchGetSecretValue' requests within a short timeframe (15 minutes). This behavioral pattern is indicative of automated bulk exfiltration of secrets from AWS Secrets Manager, a common activity following an initial cloud environment compromise.