Braintrust AWS Compromise: AI Provider Secret Exposure and Rotation Playbook

---
title: AWS CloudTrail - Access to Secrets Manager from New IP
id: 5e8f4a21-1d9c-4b5a-8f2d-9a3b4c5d6e7f
status: experimental
description: Detects when an AWS Secrets Manager secret is accessed (GetSecretValue) from a source IP address that has not been seen accessing the account in the last 30 days, indicating potential credential theft or data exfiltration.
references:
  - https://docs.aws.amazon.com/secretsmanager/
author: Security Arsenal
date: 2025/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: 'GetSecretValue'
    eventSource: 'secretsmanager.amazonaws.com'
  filter:
    userIdentity.type:
      - 'IAMUser'
      - 'AssumedRole'
  condition: selection and filter
falsepositives:
  - Legitimate access from new developer office locations
level: high
---
title: AWS CloudTrail - Console Login Without MFA
id: 7f1a2b3c-4d5e-6f78-9a0b-1c2d3e4f5a6b
status: experimental
description: Detects successful AWS Management Console logins where Multi-Factor Authentication (MFA) was not used. This is a strong indicator of compromised credentials or brute-force success.
references:
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2025/04/06
tags:
  - attack.initial_access
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: 'ConsoleLogin'
    eventSource: 'signin.amazonaws.com'
    responseElements.ConsoleLogin: 'Success'
    additionalEventData.MFAUsed: 'No'
  condition: selection
falsepositives:
  - IAM users intentionally exempt from MFA (high risk, should be rare)
level: critical

// Hunt for anomalous retrieval of AI API secrets from AWS
AWSCloudTrail
| where EventName in ("GetSecretValue", "GetParametersByPath", "GetParameter")
| where EventSource in ("secretsmanager.amazonaws.com", "ssm.amazonaws.com")
| project TimeGenerated, SourceIpAddress, UserIdentityArn, EventName, RequestParameters, ResponseElements
| extend SecretName = case(
  EventName == "GetSecretValue", tostring(RequestParameters.SecretId),
  EventName == "GetParameter", tostring(RequestParameters.Name),
  ""
)
// Filter for secrets potentially related to AI providers (OpenAI, Anthropic, etc.)
| where SecretName contains "openai" or SecretName contains "anthropic" or SecretName contains "ai-" or SecretName contains "llm"
| summarize count() by SourceIpAddress, UserIdentityArn, bin(TimeGenerated, 1h)
| where count_ > 10 // Threshold for bulk exfiltration or repeated access

-- Hunt for exposed AWS credentials or AI Keys in environment variables
-- This helps identify if the root cause was a compromised developer workstation
SELECT Pid, Name, CommandLine, Username, Envy
FROM pslist()
WHERE Name =~ 'node' OR Name =~ 'python' OR Name =~ 'java'
LET exposed_env_vars <= SELECT 
    Name,
    Value
FROM foreach(
    row=
        SELECT parse_string_with_regex(string=Envy, regex='(?P<name>[^=]+)=(?P<value>[^ ]+)') as EnvRecord
        FROM pslist()
        WHERE Envy,
    query={
        SELECT 
            get(member=EnvRecord, field="name") as Name,
            get(member=EnvRecord, field="value") as Value
        FROM scope()
    }
)
WHERE Name =~ "AWS" OR Name =~ "OPENAI" OR Name =~ "ANTHROPIC" OR Name =~ "API_KEY"

# Script to audit local environment for hardcoded AI/AWS keys
# This should be run on developer workstations and build servers

$envVars = [System.Environment]::GetEnvironmentVariables("User") + [System.Environment]::GetEnvironmentVariables("Machine")
$highRiskPatterns = @("AKIA", "sk-ant-", "sk-proj-", "OPENAI_API_KEY", "AWS_SECRET_ACCESS_KEY")

Write-Host "[+] Auditing Environment Variables for High-Risk Keys..." -ForegroundColor Cyan

Foreach ($var in $envVars.GetEnumerator()) {
    $value = $var.Value
    if ($value -is [string]) {
        foreach ($pattern in $highRiskPatterns) {
            if ($value -match $pattern) {
                Write-Host "[ALERT] Found potential exposed key in variable: " -NoNewline -ForegroundColor Red
                Write-Host $var.Name
                # Do not output the value itself to prevent logging secrets
            }
        }
    }
}

# Check .aws/credentials file if it exists
$awsCredsPath = "$env:USERPROFILE\.aws\credentials"
if (Test-Path $awsCredsPath) {
    Write-Host "[ALERT] AWS Credentials file found at: $awsCredsPath" -ForegroundColor Yellow
    Write-Host "Review this file to ensure no long-lived keys are present." -ForegroundColor Yellow
}