{"id":"T1552.005","name":"Cloud Instance Metadata API","url":"https://attack.mitre.org/techniques/T1552/005","tactics":["credential-access"],"platforms":["IaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0001","stix_id":"x-mitre-detection-strategy--6182825d-f41f-4d87-ac93-937f7894ab1d","name":"Detect Access to Cloud Instance Metadata API (IaaS)","url":"https://attack.mitre.org/detectionstrategies/DET0001","analytics":[{"id":"AN0001","stix_id":"x-mitre-analytic--f4af0b1b-db51-4266-8b02-2cdfcb191f60","name":"Analytic 0001","description":"Detects access attempts to cloud instance metadata endpoints (e.g., 169.254.169.254) from virtual machines or containerized workloads. This includes both direct access and SSRF exploitation patterns.","url":"https://attack.mitre.org/detectionstrategies/DET0001#AN0001","platforms":["IaaS"],"log_source_references":[{"name":"AWS:VPCFlowLogs","channel":"Outbound connection to 169.254.169.254 from EC2 workload","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"aws-vpcflowlogs"},{"name":"AWS:CloudTrail","channel":"GetInstanceIdentityDocument","data_component":"DC0070","data_component_name":"Cloud Service Metadata","log_source_slug":"aws-cloudtrail"},{"name":"ebpf:syscalls","channel":"Process within container accesses link-local address 169.254.169.254","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"ebpf-syscalls"}],"mutable_elements":[{"field":"TimeWindow","description":"Adjust temporal window for correlation of access attempts and SSRF triggers"},{"field":"UserContext","description":"Tune based on expected roles that access metadata APIs (e.g., root, service accounts)"},{"field":"RequestHeaderMatch","description":"Customize detection for HTTP Host headers indicating SSRF"}],"live":true,"detection_strategies":["DET0001"],"techniques":["T1552.005"]}],"live":true,"version":"1.0","techniques":["T1552.005"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}