An identity successfully extracted multiple secrets within the organization

Cortex XDR Analytics Alert Reference by Alert name

Product
Cortex XDR
Last date published
2026-03-10
Category
Analytics Alert Reference
Index by
Alert name

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

1 Hour

Deduplication Period

5 Days

Required Data

  • Requires:
    • AWS Audit Log

Detection Modules

Cloud

Detector Tags

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006)

Severity

Low

Description

An identity successfully dumped multiple secrets from the project.
This may indicate an attacker's attempt to dump sensitive information from the cloud environment.

Attacker's Goals

Collect secrets from the cloud environment.

Investigative actions

  • Check the accessed secrets' designation.
  • Verify that the identity did not dump any sensitive information that it shouldn't.

Variations

An identity successfully extracted multiple secrets within the organization across multiple regions

Synopsis

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006)

Severity

Medium

Description

An identity successfully dumped multiple secrets from the project.
This may indicate an attacker's attempt to dump sensitive information from the cloud environment.

Attacker's Goals

Collect secrets from the cloud environment.

Investigative actions

  • Check the accessed secrets' designation.
  • Verify that the identity did not dump any sensitive information that it shouldn't.


An unusual identity successfully extracted multiple secrets within the organization

Synopsis

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006)

Severity

Medium

Description

An identity successfully dumped multiple secrets from the project.
This may indicate an attacker's attempt to dump sensitive information from the cloud environment.

Attacker's Goals

Collect secrets from the cloud environment.

Investigative actions

  • Check the accessed secrets' designation.
  • Verify that the identity did not dump any sensitive information that it shouldn't.