Kubernetes Pod Exec Cloud Instance Metadata Access

Description

Detects Kubernetes pod exec sessions whose decoded command line references cloud instance metadata endpoints or equivalent hostnames and paths. Workloads that reach the link-local metadata IP, AWS IMDS paths, GCP computeMetadata, Azure IMDS token routes, or encoded variants are often attempting to harvest role credentials, tokens, or instance attributes from the underlying node or hypervisor boundary. That behavior is high risk in multi-tenant and regulated environments because it can expose short-lived cloud credentials to code running inside a container. The rule classifies a coarse cloud target label and whether the string looks like credential retrieval versus lighter reconnaissance.

Query · esql

FROM logs-kubernetes.audit_logs-* metadata _id, _index, _version
| WHERE kubernetes.audit.objectRef.subresource == "exec"
  AND kubernetes.audit.requestURI LIKE "*command=*"
| EVAL Esql.decoded_uri = URL_DECODE(kubernetes.audit.requestURI)
| GROK Esql.decoded_uri "%{DATA}/exec\\?%{DATA:raw_commands}&(?:container|stdin|stdout|stderr)=%{GREEDYDATA}"
| EVAL command = REPLACE(raw_commands, "command=", "")
| EVAL command = REPLACE(command, "&", " ")
| EVAL Esql.executed_command = REPLACE(command, "\\+", " ")
| WHERE Esql.executed_command IS NOT NULL 
  AND Esql.executed_command RLIKE """.*(169\.254\.169\.254|2852039166|0xa9fea9fe|/latest/api/token|/latest/meta-data|/latest/user-data|/latest/dynamic/instance-identity|computeMetadata/v1|metadata\.google\.internal|metadata/identity/oauth2/token|metadata/instance).*"""
| EVAL Esql.cloud_target = CASE(
    Esql.executed_command RLIKE """.*(169\.254\.169\.254|2852039166|0xa9fea9fe|/latest/meta-data|/latest/api/token|/latest/user-data|/latest/dynamic).*""", "AWS_IMDS",
    Esql.executed_command RLIKE """.*(computeMetadata/v1|metadata\.google\.internal).*""", "GCP_METADATA",
    Esql.executed_command RLIKE """.*metadata/identity/oauth2/token.*""", "AZURE_IMDS",
    "UNKNOWN"
  )
| EVAL Esql.is_credential_theft = CASE(
    Esql.executed_command RLIKE """.*(security-credentials|/api/token|oauth2/token|service-accounts/.*/token).*""", "yes",
    "recon"
  )
| KEEP Esql.*, user.name, user_agent.original, event.*, source.ip, kubernetes.audit.*, _id, _version, _index, data_stream.namespace

Analyst notes

Investigating Kubernetes Pod Exec Cloud Instance Metadata Access

This alert fires when an audited exec requestURI, after URL decoding and command reconstruction, matches patterns associated with instance metadata services across AWS, GCP, and Azure. Use it to catch interactive or scripted access from inside a pod to metadata surfaces that should usually be blocked by network policy or not needed by application code.

Possible investigation steps

  • Confirm the Kubernetes identity that performed exec: user name, groups, impersonation, source IP, and user agent.
  • Map the pod and namespace to a workload owner, image digest, and entrypoint; determine whether the container should ever call metadata endpoints.
  • Inspect Esql.cloud_target and Esql.is_credential_theft in the alert document and expand the timeline for the same identity for secret reads, IAM changes, or data egress.
  • Correlate with cloud audit logs on the node identity or instance profile for STS or token issuance around the event time.

False positive analysis

  • Break-glass debugging from platform engineers may include curl to 169.254.169.254; validate change tickets and bastion use.
  • Misconfigured agents or bootstrap scripts in bespoke images can touch metadata during startup; baseline approved images and tune exclusions narrowly.

Response and remediation

  • If unauthorized, terminate the session, isolate the workload, revoke or rotate instance and workload credentials that could have been read, and tighten RBAC on pods exec plus network policies that deny link-local metadata from pods.
Raw source Kubernetes Pod Exec Cloud Instance Metadata Access · Elastic TOML
Esc
Published by elastic/detection-rules ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[metadata]
creation_date = "2026/04/23"
integration = ["kubernetes"]
maturity = "production"
updated_date = "2026/08/18"

[rule]
author = ["Elastic"]
description = """
Detects Kubernetes pod exec sessions whose decoded command line references cloud instance metadata endpoints or
equivalent hostnames and paths. Workloads that reach the link-local metadata IP, AWS IMDS paths, GCP computeMetadata,
Azure IMDS token routes, or encoded variants are often attempting to harvest role credentials, tokens, or instance
attributes from the underlying node or hypervisor boundary. That behavior is high risk in multi-tenant and regulated
environments because it can expose short-lived cloud credentials to code running inside a container. The rule
classifies a coarse cloud target label and whether the string looks like credential retrieval versus lighter
reconnaissance.
"""
from = "now-6m"
interval = "5m"
language = "esql"
license = "Elastic License v2"
name = "Kubernetes Pod Exec Cloud Instance Metadata Access"
note = """## Triage and analysis

### Investigating Kubernetes Pod Exec Cloud Instance Metadata Access

This alert fires when an audited exec requestURI, after URL decoding and command reconstruction, matches patterns
associated with instance metadata services across AWS, GCP, and Azure. Use it to catch interactive or scripted access
from inside a pod to metadata surfaces that should usually be blocked by network policy or not needed by application
code.

### Possible investigation steps

- Confirm the Kubernetes identity that performed exec: user name, groups, impersonation, source IP, and user agent.
- Map the pod and namespace to a workload owner, image digest, and entrypoint; determine whether the container should
  ever call metadata endpoints.
- Inspect Esql.cloud_target and Esql.is_credential_theft in the alert document and expand the timeline for the same
  identity for secret reads, IAM changes, or data egress.
- Correlate with cloud audit logs on the node identity or instance profile for STS or token issuance around the event
  time.

### False positive analysis

- Break-glass debugging from platform engineers may include curl to 169.254.169.254; validate change tickets and
  bastion use.
- Misconfigured agents or bootstrap scripts in bespoke images can touch metadata during startup; baseline approved
  images and tune exclusions narrowly.

### Response and remediation

- If unauthorized, terminate the session, isolate the workload, revoke or rotate instance and workload credentials that
  could have been read, and tighten RBAC on pods exec plus network policies that deny link-local metadata from pods.
"""
references = [
    "https://attack.mitre.org/techniques/T1552/005/",
    "https://hardenedsecurity.io/blog/aws-imds-vulnerabilities-and-mitigations/",
]
risk_score = 73
rule_id = "a8e7d6c5-b4a3-2918-0f9e-8d7c6b5a4032"
severity = "high"
tags = [
    "Data Source: Kubernetes",
    "Data Source: Kubernetes API Server Audit Logs",
    "Domain: Kubernetes",
    "Platform: Kubernetes",
    "Domain: Cloud",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Tactic: Execution",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "esql"
query = '''
FROM logs-kubernetes.audit_logs-* metadata _id, _index, _version
| WHERE kubernetes.audit.objectRef.subresource == "exec"
  AND kubernetes.audit.requestURI LIKE "*command=*"
| EVAL Esql.decoded_uri = URL_DECODE(kubernetes.audit.requestURI)
| GROK Esql.decoded_uri "%{DATA}/exec\\?%{DATA:raw_commands}&(?:container|stdin|stdout|stderr)=%{GREEDYDATA}"
| EVAL command = REPLACE(raw_commands, "command=", "")
| EVAL command = REPLACE(command, "&", " ")
| EVAL Esql.executed_command = REPLACE(command, "\\+", " ")
| WHERE Esql.executed_command IS NOT NULL 
  AND Esql.executed_command RLIKE """.*(169\.254\.169\.254|2852039166|0xa9fea9fe|/latest/api/token|/latest/meta-data|/latest/user-data|/latest/dynamic/instance-identity|computeMetadata/v1|metadata\.google\.internal|metadata/identity/oauth2/token|metadata/instance).*"""
| EVAL Esql.cloud_target = CASE(
    Esql.executed_command RLIKE """.*(169\.254\.169\.254|2852039166|0xa9fea9fe|/latest/meta-data|/latest/api/token|/latest/user-data|/latest/dynamic).*""", "AWS_IMDS",
    Esql.executed_command RLIKE """.*(computeMetadata/v1|metadata\.google\.internal).*""", "GCP_METADATA",
    Esql.executed_command RLIKE """.*metadata/identity/oauth2/token.*""", "AZURE_IMDS",
    "UNKNOWN"
  )
| EVAL Esql.is_credential_theft = CASE(
    Esql.executed_command RLIKE """.*(security-credentials|/api/token|oauth2/token|service-accounts/.*/token).*""", "yes",
    "recon"
  )
| KEEP Esql.*, user.name, user_agent.original, event.*, source.ip, kubernetes.audit.*, _id, _version, _index, data_stream.namespace
'''

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1552"
name = "Unsecured Credentials"
reference = "https://attack.mitre.org/techniques/T1552/"

[[rule.threat.technique.subtechnique]]
id = "T1552.005"
name = "Cloud Instance Metadata API"
reference = "https://attack.mitre.org/techniques/T1552/005/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[[rule.threat]]
framework = "MITRE ATT&CK"

[[rule.threat.technique]]
id = "T1609"
name = "Container Administration Command"
reference = "https://attack.mitre.org/techniques/T1609/"

[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.