Suspicious Instance Metadata Service (IMDS) API Command Line Execution

  1[metadata]
  2creation_date = "2024/08/22"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike", "auditd_manager"]
  4maturity = "production"
  5updated_date = "2026/05/22"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10This rule identifies various tools/scripts performing command line execution attempting to access the cloud service
 11provider's instance metadata service (IMDS) API endpoint, which can be used to retrieve sensitive instance-specific
 12information such as instance ID, public IP address, and even temporary security credentials if roles are assumed by
 13that instance.
 14"""
 15from = "now-9m"
 16index = [
 17    "endgame-*",
 18    "logs-crowdstrike.fdr*",
 19    "logs-endpoint.events.process-*",
 20    "logs-m365_defender.event-*",
 21    "logs-sentinel_one_cloud_funnel.*",
 22    "logs-system.security*",
 23    "logs-windows.forwarded*",
 24    "logs-windows.sysmon_operational-*",
 25    "winlogbeat-*",
 26    "auditbeat-*",
 27    "logs-auditd_manager.auditd-*"
 28]
 29language = "eql"
 30license = "Elastic License v2"
 31name = "Suspicious Instance Metadata Service (IMDS) API Command Line Execution"
 32note = """## Triage and analysis
 33
 34> **Disclaimer**:
 35> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 36
 37### Investigating Suspicious Instance Metadata Service (IMDS) API Command Line Execution
 38
 39This rule detects command-line tools, shells, or scripts attempting to query a cloud instance metadata endpoint from a host, which matters because that service can reveal instance details and temporary credentials attached to the workload. A common attacker pattern is gaining code execution on a cloud VM and using curl against the local metadata address to pull IAM role credentials or managed identity tokens, then reusing them to access cloud resources without passwords.
 40
 41### Possible investigation steps
 42
 43- Review the full execution chain and any referenced script or binary contents to determine whether the metadata request came from approved bootstrap or agent activity versus an interactive shell, web application process, scheduled job, or recently dropped file.
 44- Identify the initiating account, session context, and trigger for the execution to separate expected automation from hands-on-keyboard behavior, especially if it followed a remote login, privilege escalation, or exploitation event.
 45- Correlate the host and timeframe with cloud control-plane telemetry to confirm whether instance role credentials or managed identity tokens were later used against storage, secrets, IAM, subscription, or other sensitive APIs.
 46- Examine nearby endpoint activity for follow-on collection and staging behavior such as writing token output to disk, exporting environment data, invoking cloud CLIs or SDKs, compressing files, or making outbound connections to unfamiliar destinations.
 47- Validate with the asset owner whether the workload legitimately requires IMDS access, and if the activity is unexplained, contain the host and rotate any exposed instance profile or managed identity credentials.
 48
 49### False positive analysis
 50
 51- A VM bootstrap, login, or scheduled maintenance script may use curl, wget, or a shell to query IMDS for role credentials or identity tokens needed by the workload; verify the parent process, script path, and change timing with the asset owner to confirm it matches approved initialization or routine automation.
 52- An administrator or developer may manually test instance identity or application authentication from the command line during troubleshooting or deployment; verify the initiating user, interactive session context, and related change records to confirm the host and command were part of authorized maintenance.
 53
 54### Response and remediation
 55
 56- Isolate the affected host or cloud instance from the network, preserve volatile evidence per your IR process, and immediately revoke or rotate any instance profile credentials, managed identity tokens, or application secrets that could have been exposed by access to the metadata service.
 57- Remove the attacker foothold by deleting the script or binary that queried `169.254.169.254`, `metadata.google.internal`, or the Azure identity token path, and eradicate related persistence such as scheduled tasks, cron entries, systemd services, startup items, Run keys, or web shells that launched it.
 58- Terminate any active shell, interpreter, or cloud CLI sessions tied to the intrusion and review cloud activity for the retrieved credentials being used against storage, secrets, IAM, subscriptions, or other sensitive services, disabling the affected role or identity if abuse is confirmed.
 59- Restore the workload to a known-good state by rebuilding or reimaging from a trusted template, redeploying only validated application code and configuration, and do not return the original system to production unless its integrity has been fully verified.
 60- Escalate to incident response immediately if the metadata query returned temporary credentials or OAuth tokens, if those credentials were used from another host or geography, or if multiple systems show similar command-line access to the metadata service.
 61- Harden the environment by requiring IMDSv2 or equivalent protections, limiting which users, services, or containers can reach the metadata endpoint, reducing attached role permissions to least privilege, and adding detections for future `curl`, `wget`, shell, or script access to instance metadata paths.
 62"""
 63references = [
 64    "https://hackingthe.cloud/aws/general-knowledge/intro_metadata_service/",
 65    "https://www.wiz.io/blog/imds-anomaly-hunting-zero-day",
 66]
 67risk_score = 47
 68rule_id = "ecc0cd54-608e-11ef-ab6d-f661ea17fbce"
 69severity = "medium"
 70tags = [
 71    "Domain: Endpoint",
 72    "Domain: Cloud",
 73    "OS: Linux",
 74    "OS: Windows",
 75    "OS: macOS",
 76    "Use Case: Threat Detection",
 77    "Tactic: Credential Access",
 78    "Data Source: Elastic Endgame",
 79    "Data Source: Elastic Defend",
 80    "Data Source: Windows Security Event Logs",
 81    "Data Source: Microsoft Defender XDR",
 82    "Data Source: Sysmon",
 83    "Data Source: SentinelOne",
 84    "Data Source: Crowdstrike",
 85    "Data Source: Auditd Manager",
 86    "Resources: Investigation Guide",
 87]
 88timestamp_override = "event.ingested"
 89type = "eql"
 90query = '''
 91process where host.os.type in ("linux", "macos", "windows") and event.type == "start" and
 92event.action like ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started", "Process Create*") and
 93(
 94  process.name in~ (
 95    "curl", "curl.exe", "wget", "wget.exe", "bash", "dash", "sh", "tcsh", "tclsh", "wish",
 96    "csh", "zsh", "ksh", "fish", "mksh", "busybox", "powershell.exe", "cmd.exe", "pwsh.exe", "pwsh"
 97  ) or
 98  process.name like~ (".*", "python*", "perl*", "ruby*", "php*", "lua*", "java*") or
 99  ?process.executable like~ (
100    "/tmp/*", "/var/tmp/*", "/dev/shm/*", "/home/*/*", "/var/run/*", "/run/*", "/boot/*", "/.*", "C:\\Users\\*",
101    "?:\\ProgramData\\*", "/var/www/*", "./*"
102  )
103) and
104process.args like~ (
105  "*/latest/meta-data/iam/security-credentials/?*",
106  "*computeMetadata/v1/instance/service-accounts/*/oauth2/access_token*",
107  "*/metadata/identity/oauth2/token*resource=*"
108)
109'''
110
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113
114[[rule.threat.technique]]
115id = "T1552"
116name = "Unsecured Credentials"
117reference = "https://attack.mitre.org/techniques/T1552/"
118
119[[rule.threat.technique.subtechnique]]
120id = "T1552.005"
121name = "Cloud Instance Metadata API"
122reference = "https://attack.mitre.org/techniques/T1552/005/"
123
124[rule.threat.tactic]
125id = "TA0006"
126name = "Credential Access"
127reference = "https://attack.mitre.org/tactics/TA0006/"
128
129[[rule.threat]]
130framework = "MITRE ATT&CK"
131
132[[rule.threat.technique]]
133id = "T1016"
134name = "System Network Configuration Discovery"
135reference = "https://attack.mitre.org/techniques/T1016/"
136
137[[rule.threat.technique]]
138id = "T1082"
139name = "System Information Discovery"
140reference = "https://attack.mitre.org/techniques/T1082/"
141
142[[rule.threat.technique]]
143id = "T1580"
144name = "Cloud Infrastructure Discovery"
145reference = "https://attack.mitre.org/techniques/T1580/"
146
147[rule.threat.tactic]
148id = "TA0007"
149name = "Discovery"
150reference = "https://attack.mitre.org/tactics/TA0007/"