Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1555.006_cloud-secrets-management-stores
Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.
Passed 21 of 22 test cases with the skill, and 16 of 22 without it.
and 4 more in the full report
5 fixed16 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
If a cloud security audit reveals that cloud accounts have overly permissive access to retrieve secrets from AWS Secrets Manager or Azure Key Vault without proper restriction, which primary Common Weakness Enumeration ID should be assigned?
| Checked | Without skill | With skill |
|---|---|---|
| Assigns CWE-522 Insufficiently Protected Credentials | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1555
Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault.
Secrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables.
If an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged Cloud Accounts or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. This can be accomplished via commands such as get-secret-value in AWS, gcloud secrets describe in GCP, and az key vault secret show in Azure.
Note: this technique is distinct from Cloud Instance Metadata API in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.
Platforms: IaaS
Identify Attack Surface: Determine if the target environment is susceptible to Cloud Secrets Management Stores by examining the target platforms (IaaS).
Assess Existing Defenses: Review whether mitigations for T1555.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 16 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.