Suspicious Azure Arc Metadata Query

Tim Peck@timpeck

•updated Mar 20, 2026•4•1•130

Detects command line executions from non-standard applications attempting to query the local Azure Arc metadata endpoints (ports 40341/40342), which may indicate an attacker enumerating or exploiting the HIMDS token service (CVE-2026-26117).