Bulk Secrets Manager Access to Crypto Custody/Private Key Vault Entries
Detects bulk read operations on AWS Secrets Manager or similar cloud secret stores where the accessed resources contain keywords related to cryptocurrency custody, private keys, or wallet material. This pattern is indicative of unauthorized exfiltration attempts by threat actors such as Slim Spider targeting digital asset infrastructure.
Microsoft Sentinel (KQL)
