2026 Critical Cloud Control Plane Detection: Cloud Security Service Disablement Across AWS/Azure/GCP
Detects unauthorized attempts to disable, suspend, or downgrade critical native cloud security and monitoring services (e.g., AWS GuardDuty, AWS Security Hub, Azure Defender for Cloud, and GCP Security Command Center). Attackers often perform these actions to evade detection of subsequent malicious activity within the cloud environment.
Microsoft Sentinel (KQL)
