This presentation covers how threat actors performed the exploitation and abuse of cloud metadata services, as well as related security hardening guidance on how to detect, remediate, and prevent this type of instance of metadata abuse in an organization’s environment. As part of this presentation, we will walk through a demo of the web application that was abused and show how easy it is to obtain credentials if the organization is using the legacy version of IMDS. Then, we show how performing the remediation techniques mentioned in the presentation, the organization will be able to block such abuse techniques.