GCP-VM - Instance Metadata Modification (startup script / SSH key injection)

Christopher Scott@Scocha

•updated Aug 8, 2026•3•0•2

This rule detects modifications to Google Cloud Compute Engine instance metadata that involve sensitive keys, specifically those related to SSH key injection (ssh-keys, sshKeys, windows-keys) or automated execution via startup scripts (startup-script, startup-script-url). Attackers often modify these fields to achieve persistence or perform privilege escalation on compromised virtual machines.