TeamPCP - AWS SecretsManager Live API Abuse

Ibrahim Saud@tektrix

•updated Jun 21, 2026•3•0•8

Correlates CI/CD runners utilizing AWS credentials to execute secretsmanager:ListSecrets or GetSecretValue outside normal parameters. This rule detects processes named 'aws' executing commands related to AWS SecretsManager, specifically 'ListSecrets' or 'GetSecretValue'.