GCP Cloud Run SSRF to metadata.google.internal service account credential theft

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects outbound network traffic from an instance or container to the Google Cloud metadata service (metadata.google.internal or 169.254.169.254). Such activity is highly indicative of Server-Side Request Forgery (SSRF) exploitation, where an attacker attempts to retrieve service account credentials or instance metadata from an internal service.