Node process probing IMDS, ECS credential and local Vault endpoints

Adarsh Pandey@Pandeyadarsh

•updated today•2•0•3

Detects a single Node or Bun process making outbound network connections to at least two of three sensitive cloud or local credential endpoints (IMDS 169.254.169.254, ECS task credentials 169.254.170.2, or local Vault 127.0.0.1:8200) within a 10-minute window, which is indicative of credential harvesting.