Detects cross-project enumeration of Google Cloud Secret Manager secrets via ListSecrets across many distinct projects by a single identity within a short window. The rule aggregates ListSecrets audit events from GCP audit logs by client.user.email and source.ip, looking for 10 or more distinct cloud.project.id values within a roughly six-minute window (lookback from now-6m, evaluated every 5m). ListSecrets does not return secret payloads, but multi-project discovery is a common reconnaissance step before AccessSecretVersion calls. Legitimate workloads (e.g., CSPM, inventory, red-team exercises, or admin activities) may trigger similar bursts; triage should confirm the principal, source IP, and user agent against known tooling and baselines. The rule maps to MITRE ATT&CK Discovery (Cloud Service Discovery) and prioritizes rapid detection of high-risk enumeration before credential access.