Skip to content

GetParameters

AWS

GetParameters

service: AWS - SSM
techniques:

Event

Retrieves one or more parameters from AWS Systems Manager Parameter Store, optionally decrypting SecureString values.

Security Context

  • Enumerating cloud resources helps adversaries map the environment to identify high-value targets, security controls, and potential pivot points.
  • Accessing stored credentials or secrets can provide adversaries with keys to additional systems, enabling lateral movement and privilege escalation.

Log Source

CloudTrail

Sample Event

Adversarial — credential access. Draco — using stolen instance-profile credentials from the OCCAMY pipeline EC2 (same chain as aws-getauthorizationtoken) — calls GetParameters with WithDecryption: true against three SecureString parameters under /bowtruckle/prod/. The decrypt flag flips this from “innocent SSM read” to “high-fidelity credential-harvest” in every detection content library. T1552 + T1526.

{
"eventVersion": "1.09",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AROAOCCAMYP1PEL1NE02:i-0occamy0000000001",
"arn": "arn:aws:sts::555123456789:assumed-role/OccamyPipelineRole/i-0occamy0000000001",
"accountId": "555123456789",
"accessKeyId": "ASIAOCCAMY1MDS5SESS01",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AROAOCCAMYP1PEL1NE02",
"arn": "arn:aws:iam::555123456789:role/OccamyPipelineRole",
"accountId": "555123456789",
"userName": "OccamyPipelineRole"
},
"attributes": {
"creationDate": "2026-04-15T21:09:14Z",
"mfaAuthenticated": "false"
},
"ec2RoleDelivery": "2.0"
}
},
"eventTime": "2026-04-15T21:34:11Z",
"eventSource": "ssm.amazonaws.com",
"eventName": "GetParameters",
"awsRegion": "us-east-1",
"sourceIPAddress": "203.0.113.66",
"userAgent": "aws-cli/1.18.147 Python/3.7.10 Linux/5.4.0-1045-aws botocore/1.18.6",
"requestParameters": {
"names": [
"/bowtruckle/prod/db/master-password",
"/bowtruckle/prod/api/stripe-webhook-secret",
"/bowtruckle/prod/oauth/google-client-secret"
],
"withDecryption": true
},
"responseElements": null,
"requestID": "90000000-0000-4000-8000-000101000000",
"eventID": "90000000-0000-4000-8000-000101000001",
"readOnly": true,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "555123456789",
"eventCategory": "Management",
"tlsDetails": {
"tlsVersion": "TLSv1.3",
"cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "ssm.us-east-1.amazonaws.com"
}
}

MITRE ATT&CK Mapping

Tactics: Credential Access Discovery

Techniques:
  • T1552 — Unsecured Credentials — Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or applica...
  • T1526 — Cloud Service Discovery — An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can...