Detect Cloud Instance Metadata API in Elastic Security
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud providers host a metadata API at http://169.254.169.254 (AWS, Azure, GCP, DigitalOcean) or http://fd00:ec2::254 (AWS IPv6). This internal endpoint provides running instances with credentials including temporary IAM role credentials (AWS), managed identity tokens (Azure), and service account tokens (GCP). Adversaries with code execution on a VM can query this endpoint directly, or exploit Server-Side Request Forgery (SSRF) vulnerabilities in public-facing applications to retrieve cloud credentials from external networks. TeamTNT, Peirates, and Hildegard have all exploited this API. The Capital One breach involved SSRF to the metadata API.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.005 Cloud Instance Metadata API
- Canonical reference
- https://attack.mitre.org/techniques/T1552/005/
Elastic Detection Query
any where
(
// Pattern 1: Network connections to metadata API endpoints
(
event.category == "network" and
(
destination.ip == "169.254.169.254" or
destination.address == "169.254.169.254" or
url.domain == "metadata.google.internal" or
destination.address == "fd00:ec2::254"
) and
not process.name in~ ("AzureGuestAgent.exe", "WindowsAzureGuestAgent.exe", "WaAppAgent.exe",
"aws-cfn-bootstrap", "cloud-init", "amazon-ssm-agent",
"google_guest_agent", "waagent")
)
or
// Pattern 2: Process execution with metadata API strings in args
(
event.category == "process" and
event.type == "start" and
(
process.args : "*169.254.169.254*" or
process.command_line : "*169.254.169.254*" or
process.command_line : "*metadata/instance*" or
process.command_line : "*iam/security-credentials*" or
process.command_line : "*latest/meta-data*" or
process.command_line : "*latest/dynamic*" or
process.command_line : "*instance-identity*" or
process.command_line : "*computeMetadata*" or
process.command_line : "*metadata.google.internal*" or
process.command_line : "*imds.azure.com*" or
process.command_line : "*metadata/v1*"
) and
not process.name in~ ("aws-cfn-bootstrap", "cloud-init", "amazon-ssm-agent",
"google_guest_agent", "waagent", "AzureGuestAgent.exe")
)
)Detects access to Cloud Instance Metadata API (IMDS) via network connections to 169.254.169.254 or via process command lines containing metadata API paths. Covers AWS, Azure, and GCP metadata endpoints. Excludes known legitimate cloud agent processes.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate cloud management agents (AzureGuestAgent, amazon-ssm-agent, google_guest_agent, cloud-init) querying IMDS for normal operation — these are whitelisted but custom agents may also legitimately access IMDS
- DevOps tooling such as Terraform, Packer, Ansible, or Chef running on cloud instances that retrieve metadata for provisioning or configuration management purposes
- Custom application health check scripts or monitoring agents that query instance metadata to retrieve region, instance ID, or other non-credential metadata for logging or configuration
Other platforms for T1552.005
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Query AWS Instance Metadata for IAM Credentials
Expected signal: Linux auditd EXECVE records for curl with 169.254.169.254 metadata URLs. CONNECT syscall to 169.254.169.254:80. Network connection visible in /proc/net/tcp. AWS access logs would capture this if instance metadata logging is enabled.
- Test 2Query Azure IMDS for Managed Identity Token
Expected signal: Linux auditd EXECVE for curl with 169.254.169.254 and metadata/identity in args. HTTP connection to 169.254.169.254. Response contains access_token, token_type, expires_in fields.
- Test 3Query GCP Instance Metadata for Service Account Token
Expected signal: Linux auditd EXECVE for curl with metadata.google.internal URL. DNS resolution for metadata.google.internal (resolves to 169.254.169.254). Network connection to 169.254.169.254:80.
- Test 4Steal Cloud Credentials via Python SSRF Simulation
Expected signal: Linux auditd EXECVE for python3 with 169.254.169.254 URL in command. CONNECT syscall from python3 to 169.254.169.254. Unexpected process (python3) accessing metadata API.
References (8)
- https://attack.mitre.org/techniques/T1552/005/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html
- https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service
- https://cloud.google.com/compute/docs/metadata/overview
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.005/T1552.005.md
- https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
- https://blog.trendmicro.com/trendlabs-security-intelligence/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
Unlock Pro Content
Get the full detection package for T1552.005 including response playbook, investigation guide, and atomic red team tests.