Detect Cloud Instance Metadata API in Microsoft Sentinel
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud providers host a metadata API at http://169.254.169.254 (AWS, Azure, GCP, DigitalOcean) or http://fd00:ec2::254 (AWS IPv6). This internal endpoint provides running instances with credentials including temporary IAM role credentials (AWS), managed identity tokens (Azure), and service account tokens (GCP). Adversaries with code execution on a VM can query this endpoint directly, or exploit Server-Side Request Forgery (SSRF) vulnerabilities in public-facing applications to retrieve cloud credentials from external networks. TeamTNT, Peirates, and Hildegard have all exploited this API. The Capital One breach involved SSRF to the metadata API.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.005 Cloud Instance Metadata API
- Canonical reference
- https://attack.mitre.org/techniques/T1552/005/
KQL Detection Query
// Detect Cloud Instance Metadata API access
let MetadataEndpoints = dynamic(["169.254.169.254", "fd00:ec2::254", "metadata.google.internal"]);
// Pattern 1: Network connections to metadata API IP
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in (MetadataEndpoints) or RemoteUrl has "169.254.169.254"
| where InitiatingProcessFileName !in~ ("AzureGuestAgent.exe", "WindowsAzureGuestAgent.exe",
"WaAppAgent.exe", "aws-cfn-bootstrap", "cloud-init",
"amazon-ssm-agent", "google_guest_agent")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
RemoteIP, RemotePort, RemoteUrl
| union (
// Pattern 2: Process command lines querying metadata API
DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (
"169.254.169.254",
"metadata/instance", "metadata/v1", "meta-data",
"latest/meta-data", "latest/dynamic",
"instance-identity", "iam/security-credentials",
"computeMetadata", "metadata.google.internal",
"imds.azure.com"
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
)
| sort by Timestamp descDetects Cloud Instance Metadata API access via two patterns: network connections to the link-local metadata IP 169.254.169.254 from unexpected processes (not cloud agents); and process command lines explicitly referencing metadata API paths (/latest/meta-data, /iam/security-credentials, computeMetadata). Covers AWS, Azure IMDS, and GCP metadata service endpoints.
Data Sources
Required Tables
False Positives & Tuning
- Cloud agent software legitimately querying instance metadata (AWS SSM Agent, Azure Guest Agent, Google Guest Agent)
- Application frameworks that read instance metadata to determine their cloud environment (AWS SDK, Azure SDK, GCP client libraries)
- Container orchestration tools (Kubernetes node agents, Docker) querying instance metadata for configuration
- Cloud monitoring agents (CloudWatch, Azure Monitor, Stackdriver) that collect instance metadata as part of telemetry
- Instance initialization scripts (cloud-init, UserData scripts) that query metadata during VM startup
Other platforms for T1552.005
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Query AWS Instance Metadata for IAM Credentials
Expected signal: Linux auditd EXECVE records for curl with 169.254.169.254 metadata URLs. CONNECT syscall to 169.254.169.254:80. Network connection visible in /proc/net/tcp. AWS access logs would capture this if instance metadata logging is enabled.
- Test 2Query Azure IMDS for Managed Identity Token
Expected signal: Linux auditd EXECVE for curl with 169.254.169.254 and metadata/identity in args. HTTP connection to 169.254.169.254. Response contains access_token, token_type, expires_in fields.
- Test 3Query GCP Instance Metadata for Service Account Token
Expected signal: Linux auditd EXECVE for curl with metadata.google.internal URL. DNS resolution for metadata.google.internal (resolves to 169.254.169.254). Network connection to 169.254.169.254:80.
- Test 4Steal Cloud Credentials via Python SSRF Simulation
Expected signal: Linux auditd EXECVE for python3 with 169.254.169.254 URL in command. CONNECT syscall from python3 to 169.254.169.254. Unexpected process (python3) accessing metadata API.
References (8)
- https://attack.mitre.org/techniques/T1552/005/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html
- https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service
- https://cloud.google.com/compute/docs/metadata/overview
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.005/T1552.005.md
- https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
- https://blog.trendmicro.com/trendlabs-security-intelligence/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
Unlock Pro Content
Get the full detection package for T1552.005 including response playbook, investigation guide, and atomic red team tests.