Techniques › T1552.005 › AN0001
AN0001 Analytic 0001
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects access attempts to cloud instance metadata endpoints (e.g., 169.254.169.254) from virtual machines or containerized workloads. This includes both direct access and SSRF exploitation patterns.</p>
- Detects
- T1552.005 Cloud Instance Metadata API
- Part of
- DET0001 Detect Access to Cloud Instance Metadata API (IaaS)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:VPCFlowLogs | Outbound connection to 169.254.169.254 from EC2 workload | DC0082 Network Connection Creation |
| AWS:CloudTrail | GetInstanceIdentityDocument | DC0070 Cloud Service Metadata |
| ebpf:syscalls | Process within container accesses link-local address 169.254.169.254 | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Adjust temporal window for correlation of access attempts and SSRF triggers |
UserContext | Tune based on expected roles that access metadata APIs (e.g., root, service accounts) |
RequestHeaderMatch | Customize detection for HTTP Host headers indicating SSRF |