SANS ISC: Observed Scans Targeting Cloud Metadata Service (IMDS)

Thu, 20 Aug 2026 11:39:11 +0000

Engineer — Plan: Reinforces the need to enforce IMDSv2 (hop-limit 1, require session tokens) on all EC2/GCP/Azure VMs and audit IAM role assignments to minimize credential scope accessible via the metadata endpoint.
SOC/IR — Learn: No new IOCs or campaign detail here, but a useful reminder to verify detections exist for unusual internal requests to 169.254.169.254, which can indicate SSRF or compromised workload attempts to harvest credentials.
Leader — Skip

Imds on CuraSec