Cloud IMDS Credential Theft and Exfiltration

Ankit Mehta@Secvyn

•updated Jun 26, 2026•1•0•3

Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.