Home/ MITRE Matrix/ Credential Access/ T1555.006

T1555.006Cloud Secrets Management Stores

T1555.006 — Cloud Secrets Management Stores is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 2 detection use cases covering it and 2 threat-intel articles citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

2Use cases

2Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1555 · Credentials from Password Stores

Use cases covering this technique (2)

[LLM] Cloud metadata service hit (IMDSv2 / ECS) from node process under node_modules Bespoke actions · alerting DSΣPDDCSCW [LLM] Bun/Node initiating multi-cloud secret-manager enumeration burst (Sha1-Hulud aL0 harvest) Bespoke actions · alerting DSPDDCS

Articles citing this technique (2)

high Typosquatted npm packages used to steal cloud and CI/CD secrets art-183

high Sha1-Hulud: The Second Coming - Zapier, ENS Domains, and Other Prominent NPM Packages Compromised art-653