Cloud IMDS 169.254.169.254 Access by Suspicious Process - T1552.005

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•3

Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.