Cloud Control Plane Threat Detection

The control plane provides the APIs used to manage cloud resources and access. Creating a virtual machine, assigning a role, changing a storage policy, or disabling logging are all administrative operations that can leave audit records.

Those records help answer four questions: who acted, what they targeted, where the request came from, and whether it succeeded.

Here is an illustrative sequence involving a compromised administrator account. The account already has permission to create credentials and grant access.

An investigator should check the successful operations, effective permissions, credential relationships, and approved changes behind this sequence.

The key point is the connection between the events. A rule looking only for key creation would miss much of the story.

Azure resource activity and Entra directory activity describe different parts of the environment. Investigations often need both.

Elevating Azure access gives a Global Administrator the ability to manage access at root scope. It should be investigated as a significant permission change, with the resulting assignments and activity examined.

Key Vault secret reads require separate attention. They are data-plane operations, so configure the relevant resource logging rather than expecting the Azure Activity log to provide the full record.

A useful baseline describes expected behavior for a particular identity and function. Comparing every account against the same pattern creates unnecessary alerts.

Separate human administrators, service accounts, deployment pipelines, and provider-managed activity.

Useful baseline attributes include:

• Normal source networks and access paths.
• Expected roles and cross-account relationships.
• Services, resources, and regions used.
• Typical operations and deployment schedules.
• Credential creation and rotation patterns.
• Approved administrative tools and automation.

Use enough history to capture normal operational variation, but do not make a fixed history window a prerequisite for detecting a dangerous change.

An unfamiliar network is a lead, not a verdict. VPNs, hosted runners, new deployments, and provider services can all change the apparent source of legitimate activity.

A detection can only use records that are generated, delivered, and retained. Validate those stages separately.

CloudTrail Event history provides 90 days of recorded management events on a regional basis. Ongoing centralized collection and longer retention require additional configuration.

Organization trails can simplify AWS account coverage, including newly added member accounts. Still verify region settings, event selection, delivery permissions, and destination health.

Account for collection delays. Correlate on event timestamps while retaining arrival times, and allow investigations to incorporate records that arrive later.

A quiet source may be healthy and inactive. A missing source may be broken or tampered with. Health monitoring should help distinguish the two.

A rule matching a sample event is only part of the test. Validate the path from cloud activity to investigation and response.

Use a controlled account or test environment to exercise representative scenarios:

Include legitimate administration in the test set. A useful detection should identify concerning activity without turning every deployment into an incident.

Measure evidence completeness and analyst effort alongside detection time. Retest when account structure, logging, identities, or collection methods change.