# Source: https://docs.datadoghq.com/security/default_rules/02d-y74-06e.md

---
title: User enumerated AWS Systems Manager parameters - Anomaly
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > User enumerated AWS Systems Manager
  parameters - Anomaly
---

# User enumerated AWS Systems Manager parameters - Anomaly
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1555-credentials-from-password-stores](https://attack.mitre.org/techniques/T1555) 
## Goal{% #goal %}

Detect when a user is attempting to retrieve a high number of parameters, through Cloudtrail's [`GetParameter`](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetParameter.html) event.

## Strategy{% #strategy %}

This rule sets a baseline for user activity in the `GetParameter` event, and enables detection of potentially anomalous activity when a user attempts to retrieve an anomalous volume of parameters.

An attacker may attempt to enumerate and access the AWS Systems Manager to gain access to Application Programming Interface (API) keys, database credentials, Identity and Access Management (IAM) permissions, Secure Shell (SSH) keys, certificates, and more. Once these credentials are obtained, they can be used to perform lateral movement and access restricted information.

## Triage and response{% #triage-and-response %}

1. Investigate API activity for `{{@userIdentity.session_name}}` to determine if the specific set of API calls are malicious.
   - Use the investigation queries on the suggested actions panel.
1. Review any other security signals for `{{@userIdentity.session_name}}`.
1. If the activity is deemed malicious:
   - Rotate user credentials.
   - Determine what other API calls were made by the user.
   - Rotate any parameters that were accessed by the user with the `aws-cli` command [`put-parameter`](https://docs.aws.amazon.com/cli/latest/reference/ssm/put-parameter.html).
   - Begin your organization's incident response process and investigate.
1. If the activity is benign:
   - Use the linked blog post in the suggested actions panel to tune out noise.