This rule detects HTTP requests to the Azure WireServer (IP 168.63.129.16) that query for GoalState, transport certificates, version information, or HostGAPlugin vmSettings, specifically when the request originates from a non-guest-agent user agent. It excludes known guest agents (WALinuxAgent*, VMAgent*, Python-urllib*, cpprestsdk*, ACMS*) and requests with no user agent. Implemented as an Elastic EQL rule against logs-network_traffic.http*, it matches either: (a) url.query containing comp=versions, comp=goalstate, or comp=certificates, or (b) destination.port 32526 with url.path /versions or /vmSettings. The rule focuses on URI, port, and user_agent.original; body capture should not be enabled since /vmSettings responses can be large. Triaging involves validating the matched fields, correlating with endpoint network events to the same host, and examining related process events (e.g., openssl) or storage access patterns (SAS GetBlob). False positives may arise from legitimate health checks using curl; exclude the specific UA/host as needed. Remediation steps include isolating the VM, rotating any secrets in vmSettings, reviewing extension protectedSettings, and enforcing Metadata Security Protocol controls to limit WireServer access.