Azure Instance Metadata Service Discovery
This rule detects HTTP requests to the Azure Instance Metadata Service (IMDS) IP address (169.254.169.254) with the URI containing 'metadata/instance'. This activity indicates an attempt to discover information about the Azure virtual machine instance, which can be a legitimate administrative action or an adversary attempting to collect credentials and other sensitive data.
Suricata
