AN0001
Analytic 0001
IaaS
Detects access attempts to cloud instance metadata endpoints (e.g., 169.254.169.254) from virtual machines or containerized workloads. This includes both direct access and SSRF exploitation patterns.
AWS:VPCFlowLogs
Outbound connection to 169.254.169.254 from EC2 workload
AWS:CloudTrail
GetInstanceIdentityDocument
ebpf:syscalls
Process within container accesses link-local address 169.254.169.254
[TimeWindow]
Adjust temporal window for correlation of access attempts and SSRF triggers
[UserContext]
Tune based on expected roles that access metadata APIs (e.g., root, service accounts)
[RequestHeaderMatch]
Customize detection for HTTP Host headers indicating SSRF