Node process queries cloud metadata/secrets endpoints (GCP/AWS/Azure) for credential theft
This rule monitors for processes making requests to cloud instance metadata services (GCP) or accessing sensitive secrets and parameters via AWS CloudTrail. Such activity may indicate an attacker attempting to enumerate instance identities, retrieve temporary security credentials, or access managed configuration secrets.
Microsoft Sentinel (KQL)
