2026 Critical Cloud Control Plane Detection: Cross-Account/Subscription Cloud Snapshot Exfiltration (AWS/Azure/GCP)

Detects unauthorized sharing, copying, or exporting of EBS, disk, or database snapshots to external cloud accounts, subscriptions, or projects that are not present in the defined trusted allow-list for AWS, Azure, or GCP environments.