Suspicious Instance Metadata Service API Requests

Attackers frequently leverage access to cloud-hosted virtual machines to target the Instance Metadata Service (IMDS). By querying the well-known, non-routable IP address 169.254.169.254, adversaries can retrieve instance-specific metadata, such as public IP addresses, instance IDs, and - most critically - temporary IAM role credentials or managed identity tokens. This technique is often used as a post-exploitation step to escalate privileges into the cloud control plane. Defenders should monitor for unexpected network traffic directed at this endpoint from shell interpreters, scripting engines, or binaries executing from user-writable and temporary directories. The activity is distinct from legitimate bootstrap or configuration scripts, which typically execute from authorized system paths at startup.

Attack Chain

1. Attacker gains initial code execution on a cloud virtual machine via exploit or compromised credentials.
2. Attacker performs local reconnaissance to locate configuration files or shell history (Discovery).
3. Attacker uses a common tool (e.g., curl, PowerShell) or a custom script to query the IMDS endpoint at 169.254.169.254 (Discovery/Credential Access).
4. IMDS returns sensitive metadata and temporary security credentials to the attacker process.
5. Attacker captures the returned token or credential material from the process output.
6. Attacker utilizes the harvested cloud credentials to interact with cloud APIs (e.g., S3, Secrets Manager, IAM) to exfiltrate data or persist in the cloud environment (Impact).

Impact

Successful exploitation allows attackers to bypass host-level security boundaries and move laterally into the cloud control plane. By assuming the identity of the compromised instance's service role, attackers can gain unauthorized access to sensitive cloud storage, managed secrets, IAM policies, and other subscription resources, potentially leading to widespread data exposure or further infrastructure takeover.

Recommendation

1. Deploy the provided Sigma rule to identify unauthorized network connections to the IMDS endpoint.
2. Baseline your environment to distinguish between legitimate bootstrap/agent activity and malicious IMDS queries originating from interactive shells or temporary directories.
3. Enforce IMDSv2 (or equivalent provider-specific hardening) to require session tokens and disable metadata access for non-essential processes.
4. Regularly rotate instance profile and managed identity credentials if suspicious IMDS query activity is detected.