2026 Critical Cloud Control Plane Detection: First-Seen Cloud Region Compute Instance Creation (GPU/Large Types)
Detects the creation of high-cost, resource-intensive compute instances (such as GPU-enabled or large-scale VMs) within cloud regions that have not been previously utilized by the account, subscription, or project. This behavior is often indicative of unauthorized resource hijacking, such as crypto-mining or large-scale data processing by threat actors.
Microsoft Sentinel (KQL)
