Non-Agent Process Access to Cloud Instance Metadata Endpoint

Ankit Mehta@Secvyn

•updated 5 days ago•0•0•0

Detects unauthorized processes attempting to access the cloud instance metadata service (169.254.169.254). Adversaries frequently target this endpoint to extract sensitive instance information, such as IAM credentials or configuration data, typically as part of post-exploitation discovery or SSRF-based attacks.