Cloud IMDS access followed by remote token usage

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Hour
Required Data	Requires all of the following: AWS Audit Log XDR Agent
Detection Modules	Cloud
ATT&CK Tactic	Initial Access (TA0001), Credential Access (TA0006)
ATT&CK Technique	Exploit Public-Facing Application (T1190), Unsecured Credentials (T1552)
Severity	Medium

Description

A request was made to the cloud Instance Metadata Service (IMDS) followed by a remote usage of EC2 role token.

Attacker's Goals

Gain unauthorized access by leveraging valid cloud credentials.

Investigative actions

• Identify the process that accessed the IMDS on the cloud instance.
• Examine the AWS API calls made by the stolen token, focusing on unusual or sensitive actions.
• Assess the role's permissions and rotate credentials if compromise is confirmed.