IMDS Managed Identity token retrieval used to access Key Vault secrets

Emiliano Mema@Nosalva

•updated Jul 16, 2026•9•0•9

This rule monitors container logs for attempts to access the Azure Instance Metadata Service (IMDS) via the 169.254.169.254 endpoint to request OAuth tokens or access Azure Key Vault secrets. Such activity within a containerized environment is often indicative of credential theft or discovery attempts by an adversary attempting to escalate privileges using the container's managed identity.