rules: add AWS Secrets Manager BatchGetSecretValue bulk retrieval (T1555.006)

rules/cloud/aws/cloudtrail/aws_secretsmanager_batch_get_secret_value.yml

@@ -0,0 +1,26 @@
+title: AWS Secrets Manager Bulk Secret Retrieval Via BatchGetSecretValue
+id: 190abfbe-11dd-4851-942e-527883460358
+status: test
+description: |
+    Detects use of the AWS Secrets Manager BatchGetSecretValue API, which returns the values of multiple secrets in a single call.
+    Adversaries abuse this to harvest many secrets at once, frequently with a catch-all filter, lowering the API call volume compared to iterating GetSecretValue per secret.
+references:
+    - https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html
+    - https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.secretsmanager-batch-retrieve-secrets/
+author: adamalizeerj
+date: 2026-06-14
+tags:
+    - attack.credential-access
+    - attack.t1555.006
+logsource:
+    product: aws
+    service: cloudtrail
+detection:
+    selection:
+        eventSource: secretsmanager.amazonaws.com
+        eventName: BatchGetSecretValue
+    condition: selection
+falsepositives:
+    - Applications or automation that legitimately bulk read secrets
+    - Infrastructure as code or secret sync tooling enumerating secrets at scale
+level: medium