Windows - AWS Relationship probe might be identified as Malware Ops (Malops) in customer's infrastructureIssue Some customers may notice security alerts detected by their Malware OPs application, while running Discovery on AWS hosted VMs. The message in alert would look something like below: Command Line: Powershell -Command "&{Try{(New-Object System.Net.WebClient).DownloadString(\"Http://169.254.169.254/Latest/Dynamic/Instance-Identity/Document\")} Catch {}}ReleaseAnyCauseWhile running discovery we trigger the probe "Windows - AWS Relationship"This probe has a probe parameter related list "AWS_InstanceID.ps1"The powershell script used in the above probe parameter runs the below command launchProcess -computer $computer -cred $cred -command 'powershell -command "&{Try{(New-Object System.Net.WebClient).DownloadString(\"http://169.254.169.254/latest/dynamic/instance-identity/document\")} Catch {}}"' -secondsToWait 6 This command will try to retrieve Instance Identity Documents. This document from Amazon explains this in detail. Here are the relevant excerpts: Instance Identity Documents An instance identity document is a JSON file that describes an instance. The instance identity document is accompanied by a signature and a PKCS7 signature which can be used to verify the accuracy, origin, and authenticity of the information provided in the document.The instance identity document is generated when the instance is launched, and exposed to the instance through instance metadata. It validates the attributes of the instances, such as the instance size, instance type, operating system, and AMI.ResolutionThis is Expected Behaviour Due to the dynamic nature of instance identity documents and signatures, we recommend retrieving the instance identity document and signature regularly. Since this is an expected and required behaviour, we should advice customer or malware team to add this as an exception for ServiceNow Discovery. Although disabling the "Windows - AWS Relationship" probe is not recommended by ServiceNow, this can be used as a temporary workaround while customer waits for necessary approval for above exceptions. Please be aware that disabling the probe will result in loss of functionality and may cause undesired behaviour.