ECS Metadata Credential Harvesting

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•3

Detects unusual processes querying the AWS ECS metadata endpoint (169.254.170.2) to harvest container-level IAM roles and secrets. This rule specifically looks for network connections to the ECS metadata endpoint from processes commonly used for scripting or data transfer, such as node, bun, curl, and wget.