Skip to content

Cloud Instance Metadata API

Subtechnique · ATTACK:enterprise:T1552.005

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1552.005",
  "title": "Cloud Instance Metadata API",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1552/005",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--19bf235b-8620-4997-b5b4-94e0659ed7c3",
  "external_id": "T1552.005",
  "domain": "enterprise",
  "created": "2020-02-11T18:47:46.619Z",
  "modified": "2026-05-12T15:12:00.622Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "AWS Instance Metadata API",
      "url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html"
    },
    {
      "source_name": "RedLock Instance Metadata API 2018",
      "url": "https://redlock.io/blog/instance-metadata-api-a-modern-day-trojan-horse"
    },
    {
      "source_name": "Krebs Capital One August 2019",
      "url": "https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/"
    }
  ]
}

Explicit source assertions (11)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--139f26c6-3cfd-45bb-8e0a-277474d951d0

Flashpoint Mini Shai-Hulud MAY 2026 · Hunt.io TeamPCP Toolkit MAY 2026

ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14585131-d378-4589-80b2-3c6ed88cba23

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51551fb5-48df-4143-9163-9b7ffe35bf8f

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a1a3534-7e40-4179-8240-bcd52188152f

AI-Mexico-Govt-Compromise

ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c12bad3-408b-473d-86b9-cf179edce3e2

Black Hills Information Security TruffleHog January 2024 · Github TruffleSecurity Trufflehog April 2025

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac4beabf-1644-4386-b34a-ebfc6e3bd3b0

Amazon AWS IMDS V2

ATTACK:enterprise:S0683 → uses → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc953a16-2049-4050-8790-5efb54be6e34

Peirates GitHub

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ced41648-7201-4eb8-aaae-c376e05af519

Unit 42 Hildegard Malware

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2a00238-7cc5-435c-9278-3315ede691f6

Aikido Shai-Hulud September 2025

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1552.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fce13b14-c974-4de2-9dfb-7ad45bca85f0

RedLock Instance Metadata API 2018

ATTACK:enterprise:T1552.005 → subtechnique-of → ATTACK:enterprise:T1552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd7ca8e8-82fc-443d-945a-fcef3352ec8a

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.