title: Access to Cloud Instance Metadata Service via SSRF
id: 029b4967-bbf0-4716-8d75-b7e3ea8b4020
status: experimental
description: >
  Flags application-originated requests to the cloud instance metadata service
  (169.254.169.254 / fd00:ec2::254), the pivot used in the 2019 Capital One
  breach (OWASP A02:2025, ATT&CK T1552.005).
references:
  - https://attack.mitre.org/techniques/T1552/005/
author: Aivistix Research
date: 2026/07/09
tags:
  - attack.credential_access
  - attack.t1552.005
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
      - '169.254.169.254'
      - '[fd00:ec2::254]'
      - 'metadata.google.internal'
  condition: selection
falsepositives:
  - Legitimate agents/SDKs that query IMDS from approved hosts
level: high