Skip to content
Threat Feed
Subscribe

Tag

Imds

4 briefs RSS
medium advisory

Suspicious Instance Metadata Service API Requests

Attackers with initial code execution on cloud-hosted virtual machines query the Instance Metadata Service (IMDS) at 169.254.169.254 to harvest sensitive instance details and temporary security credentials for unauthorized cloud control-plane access.

credential-access discovery imds cloud-security linux windows macos
1r 1t 1i updated
medium advisory

Detection of Unauthorized Cloud Instance Metadata Service Access

Attackers exploit cloud instance metadata service (IMDS) endpoints by using command-line tools to exfiltrate temporary security credentials and sensitive configuration data, facilitating unauthorized access to cloud resources.

credential-access cloud discovery imds
1r 2t 2i updated
medium threat

Suspicious Instance Metadata Service (IMDS) API Request

This rule detects suspicious network activity from tools or scripts attempting to access the cloud service provider's Instance Metadata Service (IMDS) API endpoint, potentially retrieving sensitive instance-specific information and credentials.

exploited credential-access discovery cloud imds
3r 4t 1i
medium threat

Suspicious Instance Metadata Service (IMDS) API Command Line Execution

The rule identifies command-line executions that attempt to access cloud service provider's Instance Metadata Service (IMDS) API endpoints, potentially retrieving sensitive instance information and temporary security credentials, ultimately leading to credential access and privilege escalation within the cloud environment.

exploited Microsoft Defender XDR +4 credential-access cloud imds
2r 4t