GCP Cloud Run SSRF to Metadata Server via url= Parameter Manipulation
Detects Server-Side Request Forgery (SSRF) attempts against the Google Cloud metadata server (169.254.169.254 or metadata.google.internal) within GCP Cloud Run request logs. This rule identifies inbound requests attempting to access sensitive cloud metadata paths or tokens, often indicative of an adversary attempting to extract service account credentials or instance information.
Splunk (SPL)
