T1552.005

Unsecured Credentials: Cloud Instance Metadata API

discovered 2026-06-01

Queries AWS IMDS (169.254.169.254), ECS (169.254.170.2), Azure managed identity, and GCP metadata for credentials.

View on MITRE ATT&CK

Seen in packages

Campaigns