T1552.005sub-technique of T1552 Unsecured Credentials
Cloud Instance Metadata API
IaaSnothing on this site yetT1552.005 on attack.mitre.org
Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detect Access to Cloud Instance Metadata API (IaaS)
- Detects access attempts to cloud instance metadata endpoints (e.g., 169.254.169.254) from virtual machines or containerized workloads. This includes both direct access and SSRF exploitation patterns.
what reduces it
- M1035 Limit Access to Resource Over Network. Limit access to the Instance Metadata API using a host-based firewall such as iptables.
- M1037 Filter Network Traffic. Limit access to the Instance Metadata API. A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.
- M1042 Disable or Remove Feature or Program. Disable unnecessary metadata services and restrict or disable insecure versions of metadata services that are in use to prevent adversary access.