Contact EC2 Instance Metadata Service From Container

rule: Contact EC2 Instance Metadata Service From Container
desc: 'Detects attempts to communicate with the EC2 Instance Metadata Service from
  a container. This detection is narrowly focused and might not apply to your environment.
  In addition, it could generate noise and require fine-tuning.

  '
condition: 'outbound and container and fd.sip="169.254.169.254" and not ec2_metadata_containers

  '
output: Outbound connection to EC2 instance metadata service | connection=%fd.name
  lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_incubating
- network
- aws
- container
- mitre_credential_access
- T1552.005