AWS EKS Pod Exec Cloud Instance Metadata Access

  1[metadata]
  2creation_date = "2026/08/03"
  3integration = ["aws"]
  4maturity = "production"
  5min_stack_comments = "The AWS integration adds the aws.eks_audit data stream in package 8.9.0, which requires Kibana 9.6.0 or later."
  6min_stack_version = "9.6.0"
  7updated_date = "2026/10/20"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects Kubernetes pod exec sessions whose decoded command line references cloud instance metadata endpoints or
 13equivalent hostnames and paths. Workloads that reach the link-local metadata IP, AWS IMDS paths, GCP computeMetadata,
 14Azure IMDS token routes, or encoded variants are often attempting to harvest role credentials, tokens, or instance
 15attributes from the underlying node or hypervisor boundary. That behavior is high risk in multi-tenant and regulated
 16environments because it can expose short-lived cloud credentials to code running inside a container. The rule classifies
 17a coarse cloud target label and whether the string looks like credential retrieval versus lighter reconnaissance.
 18"""
 19from = "now-6m"
 20language = "esql"
 21license = "Elastic License v2"
 22name = "AWS EKS Pod Exec Cloud Instance Metadata Access"
 23note = """## Triage and analysis
 24
 25### Investigating AWS EKS Pod Exec Cloud Instance Metadata Access
 26This alert fires when an audited exec requestURI, after URL decoding and command reconstruction, matches patterns
 27associated with instance metadata services across AWS, GCP, and Azure. Use it to catch interactive or scripted access
 28from inside a pod to metadata surfaces that should usually be blocked by network policy or not needed by application
 29code.
 30
 31### Possible investigation steps
 32
 33- Confirm the Kubernetes identity that performed exec: user name, groups, impersonation, source IP, and user agent.
 34- Map the pod and namespace to a workload owner, image digest, and entrypoint; determine whether the container should
 35  ever call metadata endpoints.
 36- Inspect Esql.cloud_target and Esql.is_credential_theft in the alert document and expand the timeline for the same
 37  identity for secret reads, IAM changes, or data egress.
 38- Correlate with cloud audit logs on the node identity or instance profile for STS or token issuance around the event
 39  time.
 40
 41### False positive analysis
 42
 43- Break-glass debugging from platform engineers may include curl to 169.254.169.254; validate change tickets and
 44  bastion use.
 45- Misconfigured agents or bootstrap scripts in bespoke images can touch metadata during startup; baseline approved
 46  images and tune exclusions narrowly.
 47
 48### Response and remediation
 49
 50- If unauthorized, terminate the session, isolate the workload, revoke or rotate instance and workload credentials that
 51  could have been read, and tighten RBAC on pods exec plus network policies that deny link-local metadata from pods."""
 52references = ["https://hardenedsecurity.io/blog/aws-imds-vulnerabilities-and-mitigations/"]
 53risk_score = 73
 54rule_id = "401e6554-f679-5241-9e49-8f2e2b752132"
 55setup = """This rule reads EKS control-plane audit logs collected by the AWS integration
 56into `logs-aws.eks_audit-*`, where the AWS EKS audit ingest
 57pipelines normalize each audit record under `aws.eks.audit.*`.
 58
 59Enable the `audit` control-plane log type on the EKS cluster, send its
 60CloudWatch log group through the AWS integration, and confirm events carry
 61`data_stream.dataset: aws.eks_audit` and
 62`cloud.provider: aws` before enabling this rule.
 63"""
 64severity = "high"
 65tags = [
 66    "Domain: Cloud",
 67    "Domain: Containers",
 68    "Platform: AWS",
 69    "Platform: Kubernetes",
 70    "Data Source: AWS",
 71    "Data Source: Amazon Web Services",
 72    "Data Source: Kubernetes API Server Audit Logs",
 73    "Service: AWS EKS",
 74    "Use Case: Threat Detection",
 75    "Tactic: Credential Access",
 76    "Tactic: Execution",
 77    "Rule Type: ES|QL",
 78    "Threat: IMDS Credential Theft",
 79    "Resources: Investigation Guide",
 80    "Profile: Beta",
 81]
 82timestamp_override = "event.ingested"
 83type = "esql"
 84
 85query = '''
 86FROM logs-aws.eks_audit-* metadata _id, _index, _version
 87| WHERE aws.eks.audit.objectRef.subresource == "exec"
 88  AND aws.eks.audit.requestURI LIKE "*command=*"
 89| EVAL decoded_uri = URL_DECODE(aws.eks.audit.requestURI)
 90| GROK decoded_uri "%{DATA}/exec\\?%{DATA:raw_commands}&(?:container|stdin|stdout|stderr)=%{GREEDYDATA}"
 91| EVAL command = REPLACE(raw_commands, "command=", "")
 92| EVAL command = REPLACE(command, "&", " ")
 93| EVAL Esql.executed_command = REPLACE(command, "\\+", " ")
 94| WHERE Esql.executed_command IS NOT NULL
 95  AND Esql.executed_command RLIKE """.*(169\.254\.169\.254|2852039166|0xa9fea9fe|/latest/api/token|/latest/meta-data|/latest/user-data|/latest/dynamic/instance-identity|fd00:ec2::254|169\.254\.170\.23|fd00:ec2::23|/v1/credentials|computeMetadata/v1|metadata\.google\.internal|metadata/identity/oauth2/token|metadata/instance).*"""
 96| EVAL Esql.cloud_target = CASE(
 97    Esql.executed_command RLIKE """.*(169\.254\.170\.23|fd00:ec2::23|/v1/credentials).*""", "AWS_POD_IDENTITY",
 98    Esql.executed_command RLIKE """.*(169\.254\.169\.254|2852039166|0xa9fea9fe|/latest/meta-data|/latest/api/token|/latest/user-data|/latest/dynamic|fd00:ec2::254).*""", "AWS_IMDS",
 99    Esql.executed_command RLIKE """.*(computeMetadata/v1|metadata\.google\.internal).*""", "GCP_METADATA",
100    Esql.executed_command RLIKE """.*metadata/identity/oauth2/token.*""", "AZURE_IMDS",
101    "UNKNOWN"
102  )
103| EVAL Esql.is_credential_theft = CASE(
104    Esql.executed_command RLIKE """.*(security-credentials|/api/token|oauth2/token|service-accounts/.*/token|/v1/credentials).*""", "true",
105    "false"
106  )
107| KEEP Esql.*, @timestamp, user.name, source.ip, user_agent.original, event.action, aws.eks.audit.objectRef.namespace, aws.eks.audit.objectRef.name, aws.eks.audit.requestURI, aws.eks.audit.user.username, data_stream.namespace, _id, _index, _version
108'''
109
110
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113[[rule.threat.technique]]
114id = "T1552"
115name = "Unsecured Credentials"
116reference = "https://attack.mitre.org/techniques/T1552/"
117[[rule.threat.technique.subtechnique]]
118id = "T1552.005"
119name = "Cloud Instance Metadata API"
120reference = "https://attack.mitre.org/techniques/T1552/005/"
121
122
123
124[rule.threat.tactic]
125id = "TA0006"
126name = "Credential Access"
127reference = "https://attack.mitre.org/tactics/TA0006/"
128[[rule.threat]]
129framework = "MITRE ATT&CK"
130[[rule.threat.technique]]
131id = "T1609"
132name = "Container Administration Command"
133reference = "https://attack.mitre.org/techniques/T1609/"
134
135
136[rule.threat.tactic]
137id = "TA0002"
138name = "Execution"
139reference = "https://attack.mitre.org/tactics/TA0002/"