Cloud credentials accessed by network utility

Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1552-unsecured-credentials

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect when a network utility (like cURL or Wget) is used to access the cloud Instance Metadata Service (IMDS) in an interactive session.

Strategy

The IMDS is a link-local HTTP endpoint that provides data about a given cloud instance. One function is to provide temporary security credentials so that they do not need to be stored on the host. Because IMDS can be used to fetch security credentials, attackers may use it to escalate privileges in order to access other cloud resources. This detection identifies when Linux network utilities are used in an interactive session to access the metadata service. It is unusual for this activity to occur interactively, especially in production environments.

Requires Agent version 7.27 or later.