Sunturai
Back to results
HighElastic detection rulesElastic

GCP Secret Manager ListSecrets Across Multiple Projects

Detects a single identity listing Google Cloud Secret Manager secrets across many distinct projects in a short window. ListSecrets does not return secret values, but sweeping many projects is a common reconnaissance…

Description

Detects a single identity listing Google Cloud Secret Manager secrets across many distinct projects in a short window. ListSecrets does not return secret values, but sweeping many projects is a common reconnaissance step before targeted AccessSecretVersion calls. Legitimate workloads typically list secrets within one project or a small set of projects; cross-project bursts from one user and source IP are uncommon outside security tooling or compromise.

Detection logic

Its licence does not clear it for publishing here

Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.

Sign in to read itCreate an account

Detection requirements

Platform
IaaSIdentity ProviderOffice SuiteSaaS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Known benign triggers

  • Organization-wide security scanners, CSPM products, inventory jobs, or approved red-team exercises may list secrets across many projects. Validate the principal, source IP, user agent, and schedule against known tooling before treating the activity as malicious, and exclude documented automation identities when baselined.
  • Platform or IAM administrators troubleshooting Secret Manager access across environments may briefly exceed the project cardinality threshold. Correlate with change tickets and expected administrative clients.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice