AWS Instance Metadata Service Queried for Credentials - *nix [snowflake-crowdstrikefdr_process]
The AWS Instance Metadata Service (IMDS) provides detailed information about EC2 instances, including identity documents, network details, security credentials, and user data. It also offers dynamic data about the instance's AMI, reservation information, and configuration scripts passed on instance launch. Threat actors have been observed querying the AWS IMDS for security credentials or account IDs in attacks, such as the Capital One breach in 2019 or attack attempts by threat actor group Kinsing. This use case detects queries to 169.254.169.254/latest/meta-data/iam/security-credentials or http://169.254.169.254/latest/latest/dynamic/instance-identity/document with a status code in the 200s (indicates successful connection). Legitimate services within your infrastructure may access the IMDS; validating and allowlisting is recommended.
Detection Logic
select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and (event_platform ilike '%Lin%' or event_platform ilike '%Mac%') and process ilike '%http://169.254.169.254%' and (process ilike '%latest/meta-data/iam/security-credentials/%' or process ilike '%/latest/latest/dynamic/instance-identity/document%')Field Validations
Loading…
Comments (0)
Loading comments...