Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Credential Access/ T1552.005

T1552.005Cloud Instance Metadata API

T1552.005 — Cloud Instance Metadata API is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 29 detection use cases covering it and 19 threat-intel articles citing it.

Credential Access
View on the matrix → Filter Detection Library MITRE official spec ↗
29Use cases
19Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1552 · Unsecured Credentials

Use cases covering this technique (29)

[WEEKLY] Gitea Service Account Post-Exploitation: git/gitea Spawning Interpreters or Egressing to Cloud Metadata Internal exploit · alerting DSΣPDDCS [WEEKLY] npm-install spawned process performing cred-file fan-out plus IMDS reach Internal actions · alerting DSPDDCSCW [WEEKLY] npm Install-Time Lifecycle Hook Triggers Outbound Egress to Newly-Seen Domain (Shai-Hulud/Miasma/IronWorm pattern) Internal install · alerting DSPDD [WEEKLY] SSRF-Driven Secret Egress: Public-Facing App Reaches Cloud Metadata/Attacker Host Internal actions · alerting DSΣPDDCSCW [WEEKLY] Supply-chain repo credential theft → outbound exfil to attacker infra Internal actions · alerting DSPDD [WEEKLY] Web-tier interpreter post-exploitation: shell/net-tool spawn, secret-file read, or cloud IMDS reach Internal install · alerting DSΣPDDCSCW Cisco Isovalent - Access To Cloud Metadata Service ESCU actions · hunting P [LLM] MLflow/Python server egress to cloud metadata IP 169.254.169.254 (SSRF landing) Bespoke exploit · hunting DSΣPDDCS [LLM] ChainDrop IMDS credential theft: node/bun reading cloud instance metadata (169.254.169.254 / 169.254.170.2) Bespoke actions · hunting DSΣPDDCS [LLM] Bun runtime executing Shai-Hulud Math_Symbol.js credential stealer Bespoke actions · alerting DSΣPDDCS [LLM] vault-secrets-webhook pod outbound SSRF egress to cloud IMDS (CVE-2026-54725) Bespoke c2 · alerting DSΣPCS [LLM] flyto-verification SSRF to cloud metadata IP (169.254.169.254) — runner-secret/IMDS theft Bespoke actions · hunting DSΣPDDCS [LLM] Cloud instance metadata (IMDS 169.254.169.254) queried by a recon tool inside a workload Bespoke actions · hunting DSΣPDDCS [LLM] Fluentd aggregator pod reaches EKS Instance Metadata Service (169.254.169.254) Bespoke actions · alerting DSΣPDDCS [LLM] Prebid-server access to cloud metadata service (169.254.169.254) via SSRF Bespoke actions · hunting DSΣPDDCSCW [LLM] Gitea webhook/migration SSRF reaching cloud metadata endpoints (IMDS / Azure WireServer) Bespoke actions · hunting DSΣPDDCS [LLM] Cloud IMDS credential harvesting by node/npm/bun during package install (Sha1-Hulud/Megalodon) Bespoke actions · hunting DSΣPDDCS [LLM] CI/dev host exfiltrating to api.github.com shortly after cloud IMDS harvest (Sha1-Hulud exfil chain) Bespoke actions · hunting DSPCS [LLM] Cloud instance-metadata harvesting from npm/node install context (Miasma credential theft) Bespoke actions · alerting DSPCS [LLM] AWS IMDS (169.254.169.254) Hit from Developer / Non-EC2 Endpoint (Nx Console Credential Theft) Bespoke actions · hunting DSPDDCS [LLM] node child of npm/yarn/pnpm reading cloud and CI credential files (Miasma sweep) Bespoke actions · alerting DSPDDCS [LLM] Package-manager process harvesting cloud metadata / Vault (IMDS 169.254.169.254, ECS 169.254.170.2, Vault :8200) Bespoke actions · hunting DSPDDCS [LLM] Python process contacting AWS IMDS 169.254.169.254 (litellm stealer IAM credential theft) Bespoke actions · alerting DSΣPDDCS [LLM] TeamPCP Linux credential harvest: Python reading /etc/shadow + auth.log + cloud Bespoke actions · hunting DSPDDCS [LLM] Cloud metadata service (IMDS) access from npm / node child process Bespoke actions · alerting DSPDDCS [LLM] Web-app runtime egress to AWS IMDS endpoint (169.254.169.254) — SSRF credential theft Bespoke actions · hunting DSΣPDDCS [LLM] SSRF probe via 'instance-data' IMDS alias hostname resolution Bespoke actions · hunting DSΣPDDCS [LLM] EC2 instance IMDS credential theft via curl/wget to security-credentials path Bespoke exploit · hunting DSΣPDDCS [LLM] WAF-Role EC2 instance credentials used from external IP (instance credential exfiltration) Bespoke actions · alerting PDDCW

Articles citing this technique (19)

crit [GHSA / CRITICAL] CVE-2026-64849: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated art-04
crit ChainDrop supply chain compromise: Anatomy of a self-propagating worm art-120
high Keyv and friends compromised in active Shai-Hulud supply chain attack art-134
crit [GHSA / CRITICAL] CVE-2026-54725: vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-ser art-154
crit [GHSA / CRITICAL] CVE-2026-67426: Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltr art-167
high Four incident-response decisions from the Hugging Face breach art-175
crit [GHSA / CRITICAL] CVE-2026-54680: Logging operator has Fluentd configuration injection that allows remote code execution art-176
crit [GHSA / CRITICAL] CVE-2026-54735: prebid-server's request forgery vulnerability allows for possible host environment data extraction art-177
crit [GHSA / CRITICAL] CVE-2026-22874: Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter art-231
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-292
high Multiple @immobiliarelabs Backstage Plugins Compromised on npm art-327
high Nx Console VS Code Extension Compromised art-419
crit Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm art-425
high Why developer machines are now the number one target for supply chain attacks art-442
crit litellm: Credential Stealer Hidden in PyPI Wheel art-587
crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605
high SHA1-Hulud, npm supply chain incident art-796
high Preventing server-side request forgery in Node.js applications art-1421
high A technical analysis of the Capital One cloud misconfiguration breach art-3518