---
title: Tip: alert when an AWS secret is read from somewhere new, and stop keeping cloud keys in web.config | ctxsec
url: https://ctxsec.com/items/tip-alert-on-getsecretvalue-from-new-infrastructure-and-rotate-web-config-secrets
description: "In the AntiFox intrusions, most API calls failed but the few that worked reached production secrets. A small set of alerts and cleanups catches that pattern early."
status: "operational guidance, drawn from Arctic Wolf Labs' AntiFox defensive considerations (Nov 10, 2026)"
published: 2026-11-11
---

> In the AntiFox intrusions, most API calls failed but the few that worked reached production secrets. A small set of alerts and cleanups catches that pattern early.

[← Tips & Guides](/tips) · [markdown](/items/tip-alert-on-getsecretvalue-from-new-infrastructure-and-rotate-web-config-secrets.md)

operational guidance, drawn from Arctic Wolf Labs' AntiFox defensive considerations (Nov 10, 2026)

2026-11-11 11:37 AM ET

### Tip: alert when an AWS secret is read from somewhere new, and stop keeping cloud keys in web.config

- **Alert:** successful `secretsmanager:GetSecretValue` from an IP or ASN the identity has not used before, especially after a burst of AccessDenied errors.
- **Alert:** one source using several access keys or roles within minutes.
- **Turn on:** CloudTrail management events everywhere, S3 data events and versioning (Object Lock for critical buckets) so deletions can be seen and undone.
- **Clean up:** move AWS keys and database passwords out of `web.config`, app settings and debug logs; prefer instance roles with IMDSv2 and a hop limit of 1.
- **Trim:** application identities rarely need account-wide List permissions; remove them.

Sources: [Arctic Wolf Labs pack alert: AntiFox agentic pentesting platform used to steal AWS credentials (Nov 10, 2026)](https://github.com/rtkwlf/wolf-tools/tree/main/pack_alerts/202611-antifox-alibaba-hosted-platforms-facilitate-web-cloud-intrusions)