Samirbous c704dd980e [New] Cloud Instance Metadata Credential Path HTTP Request (#6185) ...

* [New] Cloud Instance Metadata Credential Path HTTP Request

Detects HTTP GET requests to the link-local instance metadata service (169.254.169.254) for cloud credential or token paths on AWS, GCP, or Azure. Adversaries and vulnerable workloads use scripts, shells, or application runtimes to read IAM role credentials or OAuth tokens from the metadata API. Requires the Network Packet Capture integration with HTTP decoding on ports 80 and 443 and process enrichment enabled so `process.*` fields are present.

* Update credential_access_cloud_imds_credential_http_request.toml

* Update credential_access_cloud_imds_credential_http_request.toml

* Update credential_access_cloud_imds_credential_http_request.toml

* Update credential_access_cloud_imds_credential_http_request.toml

* Update credential_access_cloud_imds_credential_http_request.toml

* Update credential_access_cloud_imds_credential_http_request.toml

* Update rules/network/credential_access_cloud_imds_credential_http_request.toml

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>

* Update credential_access_cloud_imds_credential_http_request.toml

* Update rules/network/credential_access_cloud_imds_credential_http_request.toml

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

---------

Co-authored-by: Ruben Groenewoud <78494512+Aegrah@users.noreply.github.com>
Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>

(cherry picked from commit dbeffd1c5e)

2026-05-27 08:40:05 +00:00

..

collection_fortigate_config_download.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

command_and_control_accepted_default_telnet_port_connection.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

command_and_control_cobalt_strike_beacon.toml

[Rule Tuning] Network Rules Update Type and Status Field Names (#6043)

2026-05-06 18:58:34 +00:00

command_and_control_cobalt_strike_default_teamserver_cert.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

command_and_control_download_rar_powershell_from_internet.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

command_and_control_fin7_c2_behavior.toml

[Rule Tuning] Network Rules Update Type and Status Field Names (#6043)

2026-05-06 18:58:34 +00:00

command_and_control_halfbaked_beacon.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

command_and_control_nat_traversal_port_activity.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

command_and_control_port_26_activity.toml

[Rule Tuning] Network Rules Deprecate Beats Indices (#5932)

2026-05-02 01:37:03 +00:00

command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml

[Rule Tuning] Network Rules Deprecate Beats Indices (#5932)

2026-05-02 01:37:03 +00:00

command_and_control_vnc_virtual_network_computing_from_the_internet.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

command_and_control_vnc_virtual_network_computing_to_the_internet.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

credential_access_cloud_imds_credential_http_request.toml

[New] Cloud Instance Metadata Credential Path HTTP Request (#6185)

2026-05-27 08:40:05 +00:00

defense_evasion_fortigate_overly_permissive_firewall_policy.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

discovery_potential_network_sweep_detected.toml

[Rule Tuning] Add Supplemental Mitre Mappings (#5876)

2026-04-01 14:16:50 +00:00

discovery_potential_port_scan_detected.toml

Tuning to allow for greater flexibility in integration policy (#5774)

2026-02-25 19:00:07 +00:00

discovery_potential_syn_port_scan_detected.toml

Tuning to allow for greater flexibility in integration policy (#5774)

2026-02-25 19:00:07 +00:00

initial_access_fortigate_admin_login_multi_srcip.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

initial_access_fortigate_sso_login_from_unusual_source.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

initial_access_newly_observed_fortigate_admin_logon.toml

[Rule Tuning] First-Time FortiGate Administrator Login (#6095)

2026-05-13 13:25:04 +00:00

initial_access_potential_cpanel_whm_crlf_authentication_bypass.toml

[New] Potential cPanel WHM CRLF Authentication Bypass (CVE-2026-41940) (#6102)

2026-05-18 12:12:01 +00:00

initial_access_react_server_components_rce_attempt.toml

[New Rule] React2Shell Detection (#5408)

2025-12-05 18:37:54 -05:00

initial_access_react_server_rce_network_alerts.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

initial_access_rpc_remote_procedure_call_from_the_internet.toml

[Rule Tuning] Network Rules Deprecate Beats Indices (#5932)

2026-05-02 01:37:03 +00:00

initial_access_rpc_remote_procedure_call_to_the_internet.toml

[Rule Tuning] Network Rules Deprecate Beats Indices (#5932)

2026-05-02 01:37:03 +00:00

initial_access_smb_windows_file_sharing_activity_to_the_internet.toml

[Rule Tuning] Network Rules Deprecate Beats Indices (#5932)

2026-05-02 01:37:03 +00:00

initial_access_unsecure_elasticsearch_node.toml

[Rule Tuning] Network Rules Update Type and Status Field Names (#6043)

2026-05-06 18:58:34 +00:00

lateral_movement_dns_server_overflow.toml

[Rule Tuning] Network Rules Deprecate Beats Indices (#5932)

2026-05-02 01:37:03 +00:00

persistence_fortigate_admin_creation_unusual_source.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

persistence_fortigate_sso_login_followed_by_admin_creation.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00

persistence_fortigate_super_admin_account_creation.toml

[Rule Tuning] Change event.dataset to data_stream.dataset (#5943)

2026-04-10 16:31:57 +00:00