<<< Hide Navigation Hide TOC >>>
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure (352a918a-34d8-4882-8470-44830c507aa3)
Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.
Cluster A![]() |
Galaxy A![]() |
Cluster B![]() |
Galaxy B![]() |
Level![]() |
---|---|---|---|---|
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) | Attack Pattern | Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure (352a918a-34d8-4882-8470-44830c507aa3) | Sigma-Rules | 1 |
Domain Accounts - T1078.002 (c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f) | Attack Pattern | Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure (352a918a-34d8-4882-8470-44830c507aa3) | Sigma-Rules | 1 |
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81) | Attack Pattern | Domain Accounts - T1078.002 (c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f) | Attack Pattern | 2 |