[substrate] Add AWS IMDS credential exfil catalog entry

[gapilongo]

Problem

Cloud / IMDS coverage is currently thin in the technique catalog (38 entries today, biased toward Linux/Windows/AD/ADCS/web). When an operator finds AWS instance metadata reachable from a compromised host or via SSRF, the system has no catalog entry to anchor the answer — it falls back to model recall, which is exactly the pattern we want to avoid.

CVE-2019-19781-class operator scenario: "I got SSRF on a webapp; can I exfil AWS creds via IMDS?" should hit a catalog entry, not the model's priors.

Acceptance criteria

• New file data/technique_catalog/aws_imds_exfil.yaml following the schema of data/technique_catalog/esc1.yaml (the reference template):
  • technique_id: aws_imds_exfil
  • attack_ids: [T1552.005] (Unsecured Credentials: Cloud Instance Metadata API)
  • aliases: ["IMDS", "IMDSv1 exfil", "AWS instance metadata creds"]
  • 2+ defining_conditions (e.g. imds_v1_enabled, instance_has_role)
  • exploitation_steps: literal curl commands to enumerate role name, fetch creds, configure boto3
  • detection_signals: CloudTrail event names, GuardDuty finding types, VPC Flow Log patterns
  • hardened_mitigations: IMDSv2 enforcement via SCP, hop limit, least-privilege role
• Register concept keywords in src/agent/retrieval_coverage.py → CONCEPT_KEYWORDS_BY_CONDITION_ID
• Unit test in tests/agent/test_technique_catalog.py that loads the entry + asserts required fields
• pytest tests/agent/test_technique_catalog.py -v passes

Pointers

• Full walkthrough example in README.md → Adding content
• Schema template: data/technique_catalog/esc1.yaml
• AWS docs: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-IMDS-existing-instances.html
• MITRE T1552.005: https://attack.mitre.org/techniques/T1552/005/

Difficulty

S (1-2 hours) — most of the work is content curation, no architecture changes needed.