MITRE ATT&CK Technique
T1552.005
2 queries tagged with this technique.
View on MITRE ATT&CK →
-
Hunting
Hunt Cloud Metadata Ssrf Normalized Forms
Cloud instance-metadata SSRF across every string-form the attacker can write — dotted, dotless, octal, hex, IPv6, dashed hostnames, encoded slashes. Normalizes before matching.
-
Hunting
Hunt Metadata IP Any Encoded Form Inspecting DNS Answer
Inspects what DNS actually resolved to (the Answer field), not what the caller wrote — catches every obfuscated string form of the metadata IPs at the resolver level.