Cloud metadata service references
A tool parameter refers to a recognized cloud instance metadata address.
Why it is risky
Section titled “Why it is risky”On a cloud instance, metadata services may expose information or temporary credentials associated with the instance role. Unintended access can expand an attacker reach.
Example
Section titled “Example”An agent running on a cloud VM fetches role credentials from metadata while working on an unrelated code task.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule scans all parameters for selected AWS-compatible metadata addresses and the Google metadata hostname. It does not require an outbound-call condition.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_THREAT_IMDS_ACCESS | threat_command | Community | HIGH |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Confirm whether the request occurred on a cloud instance, what resource was requested, and whether credentials were returned. Review role permissions and subsequent use if access was unexpected.
False positives
Section titled “False positives”Cloud diagnostics, approved SDK setup, and documentation containing a metadata address can trigger it.
False negatives
Section titled “False negatives”Other metadata endpoints, indirect requests, or credentials retrieved by an unobserved SDK subprocess can be missed.
Technical details
Section titled “Technical details”An address reference does not prove that the instance had credentials, that access succeeded, or that returned credentials left the machine.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.