Analytics BIOC Informational
✕

Unusual cloud Instance Metadata Service (IMDS) access

A request to cloud Instance Metadata Service (IMDS) was made by an unusual process. This process does not usually access the Instance Metadata Service. An attacker may extract cloud compute tokens to gain access to a cloud environment.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Unsecured Credentials: Cloud Instance Metadata API (T1552.005)
Detector tags: Kubernetes - AGENT Kubernetes Credentials Theft Analytics
Attacker's goals:

Extract sensitive cloud compute tokens to access restricted cloud resources.

Investigative actions:

Determine whether a web service was involved and if it was exploited to execute this technique. Identify any additional commands that were executed. Review the permissions assigned to the target machine to identify which resources may be affected. Examine related compute activity in the cloud audit logs.

Test period:
N/A (single event)
Deduplication:
1 Day
6 variations:
  • Unusual cloud Instance Metadata Service (IMDS) access from an unusual known Windows web service Medium (parent: Informational)
  • Unusual cloud Instance Metadata Service (IMDS) access from an unusual known web service Medium (parent: Informational)
  • Unusual cloud Instance Metadata Service (IMDS) access from an unusual known Windows shell process Medium (parent: Informational)
  • Unusual cloud Instance Metadata Service (IMDS) access from an unusual known shell process Medium (parent: Informational)
  • Unusual cloud Instance Metadata Service (IMDS) access from an unusual known Windows scripting process Medium (parent: Informational)
  • Unusual cloud Instance Metadata Service (IMDS) access from an unusual known scripting process Low (parent: Informational)