Detects endpoint network connections to 168.63.129.16, the Azure WireServer/HostGAPlugin address, on ports 80 or 32526, initiated by shells, LOLBins, GTFOBins, and scripting runtimes. This address is used by the Azure guest agent to fetch GoalState, certificates, and vmSettings. When an Azure VM is compromised, adversaries may use curl, PowerShell, openssl, bun, or similar tools to enumerate versions, fetch transport certificates, and read HostGAPlugin/vmSettings. The rule excludes the guest-agent binaries themselves and system waagent Python, but does not exclude descendants of the guest agent, so Run Command payloads can appear within that tree. It binds to network events with process context to flag potential credential access and discovery activities related to the Cloud Instance Metadata API, system information discovery, and cloud infrastructure discovery. False positives include custom inventory/health scripts that call WireServer or break-glass admin activity; validate authorization by reviewing command lines and excluding signed binaries or tasks after review. Investigate by examining process.name, process.executable, and process.command_line; correlate destination port (80/32526) with possible vmSettings or certificates reads; check for IMDS activity (169.254.169.254) and relevant Azure Activity Logs; verify if activity is sanctioned. Remediation: isolate VM, rotate identities and SAS, remove unauthorized Run Command resources, and tighten guest-agent access.