Cloud Instance Metadata API

// Detect Cloud Instance Metadata API access
let MetadataEndpoints = dynamic(["169.254.169.254", "fd00:ec2::254", "metadata.google.internal"]);
// Pattern 1: Network connections to metadata API IP
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in (MetadataEndpoints) or RemoteUrl has "169.254.169.254"
| where InitiatingProcessFileName !in~ ("AzureGuestAgent.exe", "WindowsAzureGuestAgent.exe",
                                         "WaAppAgent.exe", "aws-cfn-bootstrap", "cloud-init",
                                         "amazon-ssm-agent", "google_guest_agent")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
         RemoteIP, RemotePort, RemoteUrl
| union (
    // Pattern 2: Process command lines querying metadata API
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where ProcessCommandLine has_any (
        "169.254.169.254",
        "metadata/instance", "metadata/v1", "meta-data",
        "latest/meta-data", "latest/dynamic",
        "instance-identity", "iam/security-credentials",
        "computeMetadata", "metadata.google.internal",
        "imds.azure.com"
      )
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
)
| sort by Timestamp desc

index=linux_audit OR index=syslog OR index=aws (sourcetype="linux_audit" OR sourcetype="syslog" OR sourcetype="aws:cloudtrail")
(
  sourcetype="linux_audit" type=EXECVE
| eval CommandLine=mvjoin(mvappend(a0,a1,a2,a3,a4,a5,a6,a7,a8), " ")
| where match(CommandLine, "169\.254\.169\.254|metadata/instance|iam/security-credentials|latest/meta-data|computeMetadata|imds\.azure\.com")
  AND NOT match(CommandLine, "(aws-cfn-bootstrap|cloud-init|amazon-ssm|google_guest_agent|waagent)")
| eval AlertType="MetadataAPIProcess"
| table _time, host, auid, CommandLine, AlertType
)
OR
(
  sourcetype="syslog" ("169.254.169.254" OR "metadata/identity" OR "iam/security-credentials")
| where NOT match(_raw, "(AzureGuestAgent|WindowsAzure|amazon-ssm|google_guest|cloud-init|waagent)")
| eval AlertType="MetadataAPINetwork"
| rex field=_raw "(?P<ProcessName>\S+).*169\.254\.169\.254"
| table _time, host, ProcessName, _raw, AlertType
)
OR
(
  sourcetype="aws:cloudtrail"
  requestParameters.roleArn="*"
  eventName="GetSessionToken"
  userIdentity.type="AWSService"
  sourceIPAddress="169.254.169.254"
| eval AlertType="MetadataCredentialsUsed"
| table _time, 'userIdentity.arn', 'requestParameters.roleArn', sourceIPAddress, AlertType
)

any where
(
  // Pattern 1: Network connections to metadata API endpoints
  (
    event.category == "network" and
    (
      destination.ip == "169.254.169.254" or
      destination.address == "169.254.169.254" or
      url.domain == "metadata.google.internal" or
      destination.address == "fd00:ec2::254"
    ) and
    not process.name in~ ("AzureGuestAgent.exe", "WindowsAzureGuestAgent.exe", "WaAppAgent.exe",
                           "aws-cfn-bootstrap", "cloud-init", "amazon-ssm-agent",
                           "google_guest_agent", "waagent")
  )
  or
  // Pattern 2: Process execution with metadata API strings in args
  (
    event.category == "process" and
    event.type == "start" and
    (
      process.args : "*169.254.169.254*" or
      process.command_line : "*169.254.169.254*" or
      process.command_line : "*metadata/instance*" or
      process.command_line : "*iam/security-credentials*" or
      process.command_line : "*latest/meta-data*" or
      process.command_line : "*latest/dynamic*" or
      process.command_line : "*instance-identity*" or
      process.command_line : "*computeMetadata*" or
      process.command_line : "*metadata.google.internal*" or
      process.command_line : "*imds.azure.com*" or
      process.command_line : "*metadata/v1*"
    ) and
    not process.name in~ ("aws-cfn-bootstrap", "cloud-init", "amazon-ssm-agent",
                           "google_guest_agent", "waagent", "AzureGuestAgent.exe")
  )
)

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip,
  destinationip,
  username,
  QIDNAME(qid) AS EventName,
  CATEGORYNAME(category) AS Category,
  "processname",
  "CommandLine",
  LOGSOURCENAME(logsourceid) AS LogSource,
  magnitude
FROM events
WHERE
  starttime > NOW() - 86400000
  AND
  (
    -- Pattern 1: Network connections to metadata IP
    (
      destinationip = '169.254.169.254'
      AND "processname" NOT ILIKE '%AzureGuestAgent%'
      AND "processname" NOT ILIKE '%amazon-ssm-agent%'
      AND "processname" NOT ILIKE '%google_guest_agent%'
      AND "processname" NOT ILIKE '%cloud-init%'
      AND "processname" NOT ILIKE '%waagent%'
    )
    OR
    -- Pattern 2: Process command lines with metadata API patterns
    (
      (
        "CommandLine" ILIKE '%169.254.169.254%'
        OR "CommandLine" ILIKE '%metadata/instance%'
        OR "CommandLine" ILIKE '%iam/security-credentials%'
        OR "CommandLine" ILIKE '%latest/meta-data%'
        OR "CommandLine" ILIKE '%latest/dynamic%'
        OR "CommandLine" ILIKE '%instance-identity%'
        OR "CommandLine" ILIKE '%computeMetadata%'
        OR "CommandLine" ILIKE '%metadata.google.internal%'
        OR "CommandLine" ILIKE '%imds.azure.com%'
      )
      AND "CommandLine" NOT ILIKE '%aws-cfn-bootstrap%'
      AND "CommandLine" NOT ILIKE '%cloud-init%'
      AND "CommandLine" NOT ILIKE '%amazon-ssm%'
      AND "CommandLine" NOT ILIKE '%google_guest_agent%'
      AND "CommandLine" NOT ILIKE '%waagent%'
    )
  )
ORDER BY starttime DESC
LIMIT 500

// Cloud Instance Metadata API Access Detection
// Pattern 1: Network connections and syslog references to metadata IP
(_sourceCategory=*linux* OR _sourceCategory=*syslog* OR _sourceCategory=*audit* OR _sourceCategory=*aws* OR _sourceCategory=*cloud*)
(
  "169.254.169.254" OR "metadata.google.internal" OR "imds.azure.com" OR
  "iam/security-credentials" OR "computeMetadata" OR "latest/meta-data" OR
  "instance-identity" OR "metadata/instance"
)
| where !(_raw matches "(?i)(AzureGuestAgent|WindowsAzureGuestAgent|WaAppAgent|amazon-ssm|google_guest_agent|cloud-init|waagent|aws-cfn-bootstrap)")
| parse regex "(?<ProcessName>[\w/.-]+)(?:\[\d+\])?:" nodrop
| parse regex "(?:cmd|command|CommandLine)[=:\s]+(?<CommandLine>[^\n]{10,200})" nodrop
| parse regex "(?:src|sip|sourceip)[=:\s]+(?<SourceIP>[\d.]+)" nodrop
| parse regex "(?:dst|dip|destip|destinationip)[=:\s]+(?<DestinationIP>[\d.]+)" nodrop
| if (DestinationIP = "169.254.169.254", "NetworkAccess",
     if (CommandLine matches "*iam/security-credentials*", "CredentialAccess",
         if (CommandLine matches "*instance-identity*", "IdentityAccess", "MetadataAccess"))) as AlertType
| count as EventCount by _messageTime, _sourceHost, ProcessName, CommandLine, DestinationIP, AlertType
| where EventCount > 0
| sort by _messageTime desc

rule cloud_instance_metadata_api_access {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects access to Cloud Instance Metadata API (IMDS) via network connections or process command lines. Covers AWS (169.254.169.254, fd00:ec2::254), Azure (imds.azure.com), and GCP (metadata.google.internal). Maps to MITRE ATT&CK T1552.005."
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1552.005"
    severity = "HIGH"
    priority = "HIGH"

  events:
    (
      // Pattern 1: Network connection to metadata IP
      (
        $e.metadata.event_type = "NETWORK_CONNECTION"
        and (
          $e.target.ip = "169.254.169.254"
          or $e.target.hostname = "metadata.google.internal"
          or $e.target.hostname = "imds.azure.com"
        )
        and not re.regex($e.principal.process.file.full_path,
          `(?i)(AzureGuestAgent|WindowsAzureGuestAgent|WaAppAgent|amazon-ssm-agent|google_guest_agent|cloud-init|waagent|aws-cfn-bootstrap)`)
      )
      or
      // Pattern 2: Process execution with metadata API strings
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and (
          re.regex($e.target.process.command_line, `169\.254\.169\.254`) or
          re.regex($e.target.process.command_line, `(?i)metadata/instance`) or
          re.regex($e.target.process.command_line, `(?i)iam/security-credentials`) or
          re.regex($e.target.process.command_line, `(?i)latest/meta-data`) or
          re.regex($e.target.process.command_line, `(?i)latest/dynamic`) or
          re.regex($e.target.process.command_line, `(?i)instance-identity`) or
          re.regex($e.target.process.command_line, `(?i)computeMetadata`) or
          re.regex($e.target.process.command_line, `(?i)metadata\.google\.internal`) or
          re.regex($e.target.process.command_line, `(?i)imds\.azure\.com`)
        )
        and not re.regex($e.target.process.command_line,
          `(?i)(aws-cfn-bootstrap|cloud-init|amazon-ssm|google_guest_agent|waagent|AzureGuestAgent)`)
      )
    )

  condition:
    $e
}

// Cloud Instance Metadata API Access Detection — CrowdStrike LogScale (CQL)
// Pattern 1: Network connections to metadata endpoint IP
#event_simpleName = NetworkConnectIP4
| ipv4Destination = "169.254.169.254"
| ImageFileName = /(?i)^(?!.*(AzureGuestAgent|WindowsAzureGuestAgent|WaAppAgent|amazon-ssm-agent|google_guest_agent|cloud-init|waagent|aws-cfn-bootstrap)).*/
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ContextBaseFileName, ipv4Destination, RemotePort])

// Pattern 2: Process events with metadata API command line patterns
| union {
  #event_simpleName = ProcessRollup2
  | CommandLine = /(?i)(169\.254\.169\.254|metadata\/instance|iam\/security-credentials|latest\/meta-data|latest\/dynamic|instance-identity|computeMetadata|metadata\.google\.internal|imds\.azure\.com|metadata\/v1)/
  | CommandLine != /(?i)(aws-cfn-bootstrap|cloud-init|amazon-ssm|google_guest_agent|waagent|AzureGuestAgent)/
  | table([@timestamp, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, SHA256HashData])
}

// Pattern 3: DNS requests resolving metadata hostnames
| union {
  #event_simpleName = DnsRequest
  | DomainName = /(?i)(metadata\.google\.internal|imds\.azure\.com)/
  | ContextBaseFileName != /(?i)(AzureGuestAgent|amazon-ssm-agent|google_guest_agent|cloud-init)/
  | table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, RequestType])
}

| sort(@timestamp, order=desc, limit=500)