Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the…

T1552.005 Unsecured Credentials: Cloud Instance Metadata API

title: "T1552.005 Unsecured Credentials: Cloud Instance Metadata API"
id: 9002df93-167c-4eb5-a6d3-6e50e4f9b908
description: 'Detect Access to Cloud Instance Metadata API (IaaS), both via direct curl/wget invocation of the metadata IP and via a raw connect() syscall to 169.254.169.254, the latter added to catch SSRF-via-web-proxy access (e.g. the Capital One breach pattern) where the requesting application process never spawns curl/wget as a subprocess. (Data Component: Network Connection Creation; baseline tier: fallback.) Tune using: TimeWindow, UserContext, RequestHeaderMatch.'
references:
  - https://attack.mitre.org/techniques/T1552/005
author: Shahrukh Khan
date: 2026-03-01
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.005

logsource:
  category: network_connection
  product: linux
  service: auditd

detection:
  selection_execve:
    type: EXECVE
    a0|endswith:
      - '/curl'
      - '/wget'
    a1|contains: '169.254.169.254'
  selection_connect:
    type: SYSCALL
    syscall: connect
    daddr: '169.254.169.254'

  condition: 1 of selection_*

falsepositives:
  - Legitimate cloud-init scripts and instance bootstrap tooling also query the same metadata IP address for routine configuration purposes, whether via curl/wget or via an application making the connect() call directly (e.g. a cloud SDKs built-in metadata client).

level: high

T1552.005 — Cloud Instance Metadata API

Sigma detection rules (1)

T1552.005 Unsecured Credentials: Cloud Instance Metadata API

Related sub-techniques

Explore