Managed Identity OAuth Token Request via IMDS Metadata Endpoint

Duo Tech@duotech

•updated Jul 15, 2026•0•0•6

Detects process command lines using curl to query the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) for OAuth tokens. This behavior is indicative of an attacker attempting to leverage an Azure Managed Identity associated with a compromised virtual machine to obtain temporary security tokens for unauthorized access to other Azure resources.