| elastic |
Package Runtime Secret File Access Followed by IMDS Request |
production |
2026-10-23 |
| elastic |
AWS EKS Pod Exec Cloud Instance Metadata Access |
production |
2026-10-20 |
| elastic |
AWS EC2 Instance Console Login via Assumed Role |
production |
2026-10-06 |
| elastic |
AWS Bedrock AgentCore Execution Role Used Outside Its Runtime |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata |
production |
2026-09-25 |
| elastic |
Kubernetes Pod Exec Cloud Instance Metadata Access |
production |
2026-09-22 |
| elastic |
AWS EC2 User Data Retrieval for EC2 Instance |
production |
2026-09-18 |
| elastic |
Azure Storage Account Key Regenerated |
production |
2026-09-18 |
| elastic |
Azure Event Hub Authorization Rule Created or Updated |
production |
2026-09-18 |
| elastic |
GKE Pod Exec Cloud Instance Metadata Access |
production |
2026-09-18 |
| elastic |
Azure WireServer OpenSSL Certificate Decrypt or LinuxTransport Generation |
production |
2026-09-18 |
| elastic |
Unusual Linux User Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Windows Process Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Unusual Windows User Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Azure WireServer HTTP Request from Unexpected User Agent |
production |
2026-09-18 |
| elastic |
Cloud Instance Metadata Credential Path HTTP Request |
production |
2026-09-18 |
| elastic |
Unusual Linux Process Calling the Metadata Service |
production |
2026-09-18 |
| elastic |
Azure WireServer Unusual Process Connection |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Command Line Execution |
production |
2026-09-18 |
| elastic |
Suspicious Instance Metadata Service (IMDS) API Request |
production |
2026-09-18 |
| elastic |
Web Server Cloud Metadata SSRF Request |
production |
2026-09-18 |
| elastic |
AWS EC2 Unauthorized Admin Credential Fetch via Assumed Role |
production |
2026-09-18 |
| splunk |
Cisco Isovalent - Access To Cloud Metadata Service |
production |
2026-05-13 |