Skip to content
Azure Forensics

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.

Glossary

Instance Metadata Service (IMDS)

The VM-local endpoint at 169.254.169.254 that exposes instance metadata and issues managed identity tokens to code running on the VM.

The Azure Instance Metadata Service (IMDS) is a REST endpoint reachable only from inside a VM at 169.254.169.254. Among other things it issues access tokens for the VM's managed identities at /metadata/identity/oauth2/token, with a required Metadata: true header that Microsoft describes as an SSRF mitigation (Microsoft Learn).

Any code running on the VM can request these tokens. An attacker with code execution — for example through Run Command — can take a token and replay it from elsewhere (MITRE T1528).

See managed identity and service principal abuse.

This tool is not affiliated with, endorsed by or sponsored by Microsoft Corporation. Azure, Microsoft Azure and Microsoft Defender for Cloud are trademarks of the Microsoft group of companies. Other names are trademarks of their respective owners.