T1552.005

Unsecured Credentials: Cloud Instance Metadata API

Queries AWS IMDS (169.254.169.254), ECS (169.254.170.2), Azure managed identity, and GCP metadata for credentials.

discovered 2026-06-01
View on MITRE ATT&CK ↗

Seen in packages

Campaigns