# Detecting Anomalous Instance Metadata Service Usage to Identify Cloud Security Exploits

DevFeed: [Detecting Anomalous Instance Metadata Service Usage to Identify Cloud Security Exploits](<https://devfeed.tech/articles/imds-abused-hunting-rare-behaviors-to-uncover-exploits-53828.md>)

Original publisher: [Read original article](<https://www.wiz.io/blog/imds-anomaly-hunting-zero-day>)

Author: Gili Tikochinski

Published: 2025-09-22T14:50:13Z

Content type: article

Language: en

Sources: [Wiz](<https://devfeed.tech/sources/wiz-blog-rss-feed.md>)

Topics: [cloud security](<https://devfeed.tech/topics/cloud-security.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Amazon EC2](<https://devfeed.tech/topics/amazon-ec2.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [AWS IAM](<https://devfeed.tech/topics/aws-iam.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>)

Tags: [aws](<https://devfeed.tech/tags/aws.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [ec2](<https://devfeed.tech/tags/ec2.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [iam](<https://devfeed.tech/tags/iam.md>), [privilege-escalation](<https://devfeed.tech/tags/privilege-escalation.md>), [research](<https://devfeed.tech/tags/research.md>), [s3](<https://devfeed.tech/tags/s3.md>), [server-side-request-forgery](<https://devfeed.tech/tags/server-side-request-forgery.md>)

## AI overview

This article explains how anomalous Instance Metadata Service usage can enable credential theft, lateral movement, and privilege escalation in cloud environments. It describes IMDS use across AWS, Azure, and GCP, compares AWS IMDSv1 and IMDSv2, and discusses how the authors' detection methodology helped uncover a zero-day vulnerability exploited through a popular web service.

## Source excerpt

When common processes start asking the wrong questions