Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Unusual Windows User Calling the Metadata Service

Looks for anomalous access to the cloud platform metadata service by an unusual user. The metadata service may be targeted in order to harvest credentials or user data scripts containing secrets.

ATT&CK coverage

Credential Access

T1552Unsecured Credentials110 detections cover this technique
- T1552.005Cloud Instance Metadata API 18 detections cover this technique

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.