Part 2 covered the detection loop in general. This post is about the hardest place to close it — the cloud — where the "attack" is an API call and the "telemetry" lives in places most validation tools never look.
Execution Without Endpoints
Cloud techniques don't need an agent on a host — there is no host. Cyllex runs them against the provider's control and identity planes: AWS, Azure and GCP, plus identity-first attacks against Entra ID (the plane shared with Microsoft 365). Enumerate IAM, abuse a Key Vault, add a federated credential, create a user for persistence — all driven from the server with the provider's own APIs.
Where Cloud Detection Actually Lives
The key realization for cloud purple teaming: the client tool you attack with barely matters — what matters is the API call and the audit record it leaves. Each provider writes those records to its own place, and each has a SIEM that reads them:
- AWS → CloudTrail events → Security Hub / CloudWatch Logs (+ GuardDuty findings).
- Azure → Azure Activity (ARM) and Entra ID logs → Microsoft Sentinel.
- GCP → Cloud Audit Logs → Cloud Logging / Security Command Center.
Cyllex maps every cloud technique to the specific audit events it should generate, then queries the matching SIEM after execution — the same loop as endpoint, pointed at cloud tables instead of Windows event logs.
A Real Example: Azure → Sentinel
Take a concrete case I validated end to end. A persistence technique creates a user in Entra ID. That action writes an Add user record to the Entra AuditLogs, which flows into a Log Analytics workspace and Microsoft Sentinel. After execution, Cyllex queries Sentinel for that exact operation in the execution window — and returns Detected, with the matched operation listed.
No host, no Windows event IDs — Cyllex knows this is a cloud technique, queries the right Entra table (not endpoint logs), and classifies the result with the cloud audit-count model. Run the attack, wait for ingestion, get a verdict.
"Not Detected" Might Be Your Most Important Finding
Cloud detection has a prerequisite people forget: the data connectors must be on. If Azure Activity or Entra logs aren't being exported into the workspace — or sign-in logs require a license tier the tenant doesn't have — then the telemetry never arrives, and the technique reads as Not Detected.
That's not a false negative. It's the finding. "Your SOC is blind to this entire category of cloud telemetry" is exactly the kind of gap a purple-team engagement exists to surface. Cyllex makes it visible instead of silently assuming the logs are flowing.
Telemetry vs. Alert, in the Cloud
As in Part 2, there are two levels. Telemetry validation ("the operation was logged") is deterministic ground truth. Alert validation ("an analytic rule fired") is what truly measures SOC maturity. Cyllex starts with telemetry and can also check the alert tables — so you can answer both "did the cloud log it?" and "did anyone get paged?"
Next in the series
Part 4: Execution Models — agent, agentless, and instant agent generation.