Falco informational stable other
Contact EC2 Instance Metadata Service From Container
Detects attempts to communicate with the EC2 Instance Metadata Service from a container. This detection is narrowly focused and might not apply to your environment. In addition, it could generate noise and require fine-tuning.
Detection Logic
outbound and container and fd.sip="169.254.169.254" and not ec2_metadata_containersField Validations
Loading…
Comments (0)
Loading comments...