Cloud Instance Metadata API

ATT&CK T1552.005

Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data. Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance. Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets. The Instance Metadata API is provided as a convenience to assist in managing application

Category: Technique, credential-access

MITRE ATT&CK: T1552.005

Reference: MITRE ATT&CK T1552.005