IMDS ABUSED: HUNTING RARE BEHAVIORS TO UNCOVER EXPLOITS

Summary from the TLDR InfoSec newsletter

The Instance Metadata Service (IMDS) is a server that runs on cloud VMs (like AWS EC2) to provide short-lived credentials to applications running on them. To detect potential IMDS abuse, establish a baseline of which services frequently access IMDS and then monitor for applications that either access sensitive IMDS paths or access IMDS more frequently than usual. This post applies this methodology to hunting for a vulnerability in pandoc and Clickhouse.