SSRF Targeting GCP Metadata Service via URL Parameters in Web/Proxy Logs
Detects Server-Side Request Forgery (SSRF) attempts directed at the Google Cloud Platform (GCP) instance metadata service endpoints. The rule monitors HTTP request logs from proxies or web servers, identifying requests that contain suspicious metadata hostnames or IP addresses combined with sensitive API paths typically used for exfiltrating cloud instance identity tokens.
Sigma
