diff --git a/misconfiguration/cloud-metadata.yaml b/misconfiguration/cloud-metadata.yaml
index 9695bf2afa5..a447b01ec89 100644
--- a/misconfiguration/cloud-metadata.yaml
+++ b/misconfiguration/cloud-metadata.yaml
@@ -8,7 +8,7 @@ info:
   metadata:
     verified: true
     shodan-query: html:"instance_metadata"
-  tags: devops,cloud,aws,gcp
+  tags: misconfig,exposure,devops,cloud,aws,gcp
 
 requests:
   - method: GET
@@ -27,3 +27,10 @@ requests:
       - type: status
         status:
           - 200
+
+    extractors:
+      - type: regex
+        part: body
+        group: 1
+        regex:
+          - '"cloud":"([A-Z]+)",'