Bash script queries cloud IMDS endpoint to steal temporary credentials

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•3

Detects the use of common command-line tools (curl, wget, python, etc.) to interact with known cloud provider metadata service IP addresses or URL paths, often performed by shell processes. This behavior is frequently associated with initial reconnaissance or attempts to steal identity tokens from cloud-based virtual machines.