Detect Cloud Instance Metadata API in Splunk
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud providers host a metadata API at http://169.254.169.254 (AWS, Azure, GCP, DigitalOcean) or http://fd00:ec2::254 (AWS IPv6). This internal endpoint provides running instances with credentials including temporary IAM role credentials (AWS), managed identity tokens (Azure), and service account tokens (GCP). Adversaries with code execution on a VM can query this endpoint directly, or exploit Server-Side Request Forgery (SSRF) vulnerabilities in public-facing applications to retrieve cloud credentials from external networks. TeamTNT, Peirates, and Hildegard have all exploited this API. The Capital One breach involved SSRF to the metadata API.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1552 Unsecured Credentials
- Sub-technique
- T1552.005 Cloud Instance Metadata API
- Canonical reference
- https://attack.mitre.org/techniques/T1552/005/
SPL Detection Query
index=linux_audit OR index=syslog OR index=aws (sourcetype="linux_audit" OR sourcetype="syslog" OR sourcetype="aws:cloudtrail")
(
sourcetype="linux_audit" type=EXECVE
| eval CommandLine=mvjoin(mvappend(a0,a1,a2,a3,a4,a5,a6,a7,a8), " ")
| where match(CommandLine, "169\.254\.169\.254|metadata/instance|iam/security-credentials|latest/meta-data|computeMetadata|imds\.azure\.com")
AND NOT match(CommandLine, "(aws-cfn-bootstrap|cloud-init|amazon-ssm|google_guest_agent|waagent)")
| eval AlertType="MetadataAPIProcess"
| table _time, host, auid, CommandLine, AlertType
)
OR
(
sourcetype="syslog" ("169.254.169.254" OR "metadata/identity" OR "iam/security-credentials")
| where NOT match(_raw, "(AzureGuestAgent|WindowsAzure|amazon-ssm|google_guest|cloud-init|waagent)")
| eval AlertType="MetadataAPINetwork"
| rex field=_raw "(?P<ProcessName>\S+).*169\.254\.169\.254"
| table _time, host, ProcessName, _raw, AlertType
)
OR
(
sourcetype="aws:cloudtrail"
requestParameters.roleArn="*"
eventName="GetSessionToken"
userIdentity.type="AWSService"
sourceIPAddress="169.254.169.254"
| eval AlertType="MetadataCredentialsUsed"
| table _time, 'userIdentity.arn', 'requestParameters.roleArn', sourceIPAddress, AlertType
)Detects metadata API access using Linux auditd (EXECVE with 169.254.169.254 or metadata API paths), syslog network access patterns, and AWS CloudTrail for credential use originating from the metadata API (source IP 169.254.169.254). The AlertType field identifies the detection layer.
Data Sources
Required Sourcetypes
False Positives & Tuning
- AWS/Azure/GCP agent software querying instance metadata
- Application frameworks reading cloud environment configuration
- Container orchestration tools querying instance metadata
- Cloud monitoring agents collecting instance metadata
- Instance initialization scripts during VM startup
Other platforms for T1552.005
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Query AWS Instance Metadata for IAM Credentials
Expected signal: Linux auditd EXECVE records for curl with 169.254.169.254 metadata URLs. CONNECT syscall to 169.254.169.254:80. Network connection visible in /proc/net/tcp. AWS access logs would capture this if instance metadata logging is enabled.
- Test 2Query Azure IMDS for Managed Identity Token
Expected signal: Linux auditd EXECVE for curl with 169.254.169.254 and metadata/identity in args. HTTP connection to 169.254.169.254. Response contains access_token, token_type, expires_in fields.
- Test 3Query GCP Instance Metadata for Service Account Token
Expected signal: Linux auditd EXECVE for curl with metadata.google.internal URL. DNS resolution for metadata.google.internal (resolves to 169.254.169.254). Network connection to 169.254.169.254:80.
- Test 4Steal Cloud Credentials via Python SSRF Simulation
Expected signal: Linux auditd EXECVE for python3 with 169.254.169.254 URL in command. CONNECT syscall from python3 to 169.254.169.254. Unexpected process (python3) accessing metadata API.
References (8)
- https://attack.mitre.org/techniques/T1552/005/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-retrieval.html
- https://learn.microsoft.com/en-us/azure/virtual-machines/instance-metadata-service
- https://cloud.google.com/compute/docs/metadata/overview
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.005/T1552.005.md
- https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
- https://blog.trendmicro.com/trendlabs-security-intelligence/teamtnt-now-deploying-ddos-capable-irc-bot-tntbotinger/
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
Unlock Pro Content
Get the full detection package for T1552.005 including response playbook, investigation guide, and atomic red team tests.