kevmap

Techniques › T1552 › T1552.005

T1552.005 Cloud Instance Metadata API

credential access — IaaS · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1552.005
0
KEV CVEs mapped here
<p>Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.</p><p>Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance. A cloud metadata API has been used in at least one high profile compromise.</p><p>If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources. Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.</p><p>The de facto standard across cloud service providers is to host the Instance Metadata API at <code>http[:]//169.254.169.254</code>.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1552.005

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

Rules tagged at the parent level (attack.t1552) 13

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Script Interpreter Spawning Credential Scanner - Windows highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Techniques: T1552T1005T1059.007
Application AppID Uri Configuration Changes hightest
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' · 2022-06-02 · logsource: product=azure service=auditlogs · 1b45b0d1-773f-4f23-aedc-814b759563b1
Detects when a configuration change is made to an applications AppID URI.
Techniques: T1552T1078.004
Azure Key Vault Modified or Deleted mediumtest
Author: Austin Songer @austinsonger · 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 459a2970-bb84-4e6a-a32e-ff0fbd99448d
Identifies when a key vault is modified or deleted.
Techniques: T1552T1552.001
Google Cloud Kubernetes Admission Controller mediumtest
Author: Austin Songer @austinsonger · 2021-11-25 (modified 2022-12-18) · logsource: product=gcp service=gcp.audit · 6ad91e31-53df-4826-bd27-0166171c8040
Identifies when an admission controller is executed in GCP Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Techniques: T1078T1552T1552.007
Added Owner To Application mediumtest
Author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' · 2022-06-02 · logsource: product=azure service=auditlogs · 74298991-9fc4-460e-a92e-511aa60baec1
Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.
Techniques: T1552
Azure Keyvault Key Modified or Deleted mediumtest
Author: Austin Songer @austinsonger · 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 80eeab92-0979-4152-942d-96749e11df40
Identifies when a Keyvault Key is modified or deleted in Azure.
Techniques: T1552T1552.001
Potential Okta Password in AlternateID Field hightest
Author: kelnage · 2023-04-03 (modified 2026-04-27) · logsource: product=okta service=okta · 91b76b84-8589-47aa-9605-c837583b82a9
Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.
Techniques: T1552
EventLog Query Requests By Builtin Utilities mediumtest
Author: Ali Alwashali, Nasreddine Bencherchali (Nextron Systems) · 2023-11-20 (modified 2024-01-24) · logsource: product=windows category=process_creation · 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f
Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.
Techniques: T1552
Azure Kubernetes Admission Controller mediumtest
Author: Austin Songer @austinsonger · 2021-11-25 (modified 2022-12-18) · logsource: product=azure service=activitylogs · a61a3c56-4ce2-4351-a079-88ae4cbd2b58
Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.
Techniques: T1078T1552T1552.007
Azure Keyvault Secrets Modified or Deleted mediumtest
Author: Austin Songer @austinsonger · 2021-08-16 (modified 2022-08-23) · logsource: product=azure service=activitylogs · b831353c-1971-477b-abb6-2828edc3bca1
Identifies when secrets are modified or deleted in Azure.
Techniques: T1552T1552.001
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities mediumtest
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) · 2022-09-09 (modified 2025-12-02) · logsource: product=windows category=process_creation · beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.
Techniques: T1552T1087
Kubernetes Admission Controller Modification mediumtest
Author: kelnage · 2024-07-11 · logsource: product=kubernetes service=audit · eed82177-38f5-4299-8a76-098d50d225ab
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Techniques: T1078T1552T1552.007
Script Interpreter Spawning Credential Scanner - Linux highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Techniques: T1552T1005T1059.004