custom health checks that call hostgaplugin /versions or /vmsettings with curl. exclude the specific user agent or host group after validating the script.

Techniques

Sample rules

Azure WireServer HTTP Request from Unexpected User Agent

source: elastic
technicques:
- T1082
- T1552

Description

Identifies HTTP requests to Azure WireServer (168.63.129.16) for GoalState, certificates, versions, or HostGAPlugin vmSettings that do not use a known guest-agent user agent. These requests retrieve transport certificates and extension protectedSettings, including embedded SAS URLs. Azure Linux Agent, Windows guest agent, and related platform UAs are excluded. Requests with no user agent are also excluded; that pattern is common for the Windows guest agent.

Detection logic

network where event.module == "network_traffic" and
destination.ip == "168.63.129.16" and
user_agent.original != null and
not user_agent.original : (
  "WALinuxAgent*",
  "VMAgent*",
  "Python-urllib*",
  "cpprestsdk*",
  "ACMS/*"
) and
(
  url.query : ("*comp=versions*", "*comp=goalstate*", "*comp=certificates*") or
  (destination.port == 32526 and url.path : ("/versions", "/vmSettings"))
)