Hide Navigation Hide TOC

Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure (352a918a-34d8-4882-8470-44830c507aa3)

Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81)	Attack Pattern	Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure (352a918a-34d8-4882-8470-44830c507aa3)	Sigma-Rules	1
Domain Accounts - T1078.002 (c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f)	Attack Pattern	Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure (352a918a-34d8-4882-8470-44830c507aa3)	Sigma-Rules	1
Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81)	Attack Pattern	Domain Accounts - T1078.002 (c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f)	Attack Pattern	2