T1555.006sub-technique of T1555 Credentials from Password Stores

Cloud Secrets Management Stores

IaaSnothing on this site yetT1555.006 on attack.mitre.org

Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. Secrets managers support the secure centralized management of passwords, API keys, and other credential material.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detect Unauthorized Access to Cloud Secrets Management Stores

Detection of suspicious access to cloud-native secret management systems (AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, HashiCorp Vault). Focuses on abnormal secret retrieval activity, such as secrets being accessed by unusual identities, from unexpected regions, outside business hours, or at high volume.

what reduces it

M1026 Privileged Account Management. Limit the number of cloud accounts and services with permission to query the secrets manager to only those required. Ensure that accounts and services with permissions to query the secrets manager only have access to the secrets they require.

the rest of T1555

T1555.001 Keychain · not covered yet
T1555.002 Securityd Memory · not covered yet
T1555.003 Credentials from Web Browsers · not covered yet
T1555.004 Windows Credential Manager · not covered yet
T1555.005 Password Managers · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.