Detect Cloud Instance Metadata API in IBM QRadar

SELECT
  DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
  sourceip,
  destinationip,
  username,
  QIDNAME(qid) AS EventName,
  CATEGORYNAME(category) AS Category,
  "processname",
  "CommandLine",
  LOGSOURCENAME(logsourceid) AS LogSource,
  magnitude
FROM events
WHERE
  starttime > NOW() - 86400000
  AND
  (
    -- Pattern 1: Network connections to metadata IP
    (
      destinationip = '169.254.169.254'
      AND "processname" NOT ILIKE '%AzureGuestAgent%'
      AND "processname" NOT ILIKE '%amazon-ssm-agent%'
      AND "processname" NOT ILIKE '%google_guest_agent%'
      AND "processname" NOT ILIKE '%cloud-init%'
      AND "processname" NOT ILIKE '%waagent%'
    )
    OR
    -- Pattern 2: Process command lines with metadata API patterns
    (
      (
        "CommandLine" ILIKE '%169.254.169.254%'
        OR "CommandLine" ILIKE '%metadata/instance%'
        OR "CommandLine" ILIKE '%iam/security-credentials%'
        OR "CommandLine" ILIKE '%latest/meta-data%'
        OR "CommandLine" ILIKE '%latest/dynamic%'
        OR "CommandLine" ILIKE '%instance-identity%'
        OR "CommandLine" ILIKE '%computeMetadata%'
        OR "CommandLine" ILIKE '%metadata.google.internal%'
        OR "CommandLine" ILIKE '%imds.azure.com%'
      )
      AND "CommandLine" NOT ILIKE '%aws-cfn-bootstrap%'
      AND "CommandLine" NOT ILIKE '%cloud-init%'
      AND "CommandLine" NOT ILIKE '%amazon-ssm%'
      AND "CommandLine" NOT ILIKE '%google_guest_agent%'
      AND "CommandLine" NOT ILIKE '%waagent%'
    )
  )
ORDER BY starttime DESC
LIMIT 500