Research & Blog

Notes from the agentic SOC

Cloud attack research from the Cyngular team — control-plane abuse, identity-driven intrusions, and the detection gaps that let them hide in plain sight.

46articles

AWS 19Azure 15GCP 1Cloud 11

Cloud · Threat research

CloudOctober 202610 min read

AI SOC vs. Agentic SOC: Why Adding AI to Your SIEM Is the Easy Part

Connecting an LLM to your SIEM is not an Agentic SOC. Here's what autonomous investigation actually requires: context, grounding, trust boundaries, and cost control.

Read article

AWSApril 2026

Modern cloud attacks don't break in. They log in.

The Vercel breach reflects a fundamental shift: attackers no longer exploit infrastructure vulnerabilities — they exploit trust, and simply operate as the user.

3 min readRead

AzureMarch 2026

Legitimate by Design: The Cyberattack That Looks Like Normal Business

The March 2026 Stryker attack wasn't malware-driven. Attackers abused identity and cloud management systems to execute destructive actions at scale — entirely within expected system behavior.

7 min readRead

AzureDecember 2025

ConsentFix: Abusing Azure OAuth Consent to Take Over Microsoft Accounts

A browser-native phishing technique that compromises Microsoft accounts by abusing legitimate Entra ID OAuth flows — often without capturing passwords, and sometimes without an MFA prompt.

5 min readRead

AWSOctober 2025

The One-Line Backdoor: How a Single EventBridge Rule Becomes an Attacker's Control Channel

A configuration-only persistence mechanism: one EventBridge rule quietly forwards your events to a Lambda in an attacker's account. No malware, no rogue compute — just a line of JSON pointing somewhere you don't control.

8 min readRead

GCPSeptember 2025

Lateral Movement via External GCP Service Accounts

When Service Accounts from outside an organization are granted permissions inside projects, they become a hidden backdoor — effectively trusting another tenant's user with a permanent bridge into your cloud.

Notes from the agentic SOC

AI SOC vs. Agentic SOC: Why Adding AI to Your SIEM Is the Easy Part

Modern cloud attacks don't break in. They log in.

Legitimate by Design: The Cyberattack That Looks Like Normal Business

ConsentFix: Abusing Azure OAuth Consent to Take Over Microsoft Accounts

The One-Line Backdoor: How a Single EventBridge Rule Becomes an Attacker's Control Channel

Lateral Movement via External GCP Service Accounts

Shadow Access in AWS: Federation Attacks with Temporary STS Tokens

Forgotten Keys, Open Clouds: The Danger of Credentials Lost in SaaS

The Ghost Session Problem: The Real Persistence Threat in Azure AD

Exploiting Identity in Azure: The Real Impact of Pass-the-Token Attacks

From Denials to Breach: Detecting MFA Exploitation

From Shell to Cloudshell: The Escalation Path Attackers Use After VM Breach

Embedding Deception into Cloud CI/CD Pipelines

When ‘Contributor’ Means Control: The Hidden Risk in Azure RBAC

Pass-the-Role Attack - From Legit to Lethal

Turning the Cloud Against the Attacker - Using Deception to Uncover and Disrupt Attackers

The Threat You Didn’t See Coming - Data Exfiltration

Cloud Enumeration: The Stealthy Discovery Process in AWS

Unseen but Deadly: How Forgotten S3 Buckets Become Breach Gateways

Databricks Webhooks: A Silent Backdoor for Malicious Execution

Shadow Operations: Unraveling the Secrets of AWS SSM

From Credentials to Control: Exploiting AWS RDS

Shields Up! Exposing Hidden Threats Within EC2 Instances

Next-Level API Security: Building Resilient Node.js Microservices with NestJS

Guardians at the Gateway: Unveiling the Hidden Risks of Kubernetes Ingress

The Quiet Threat in the Cloud That Must Not Be Ignored - QA Automation

Azure Function Apps: The Hidden Dangers of Overexposed HTTP Triggers

Steering Through the Storm: Stopping ConfigMap Hackers in Their Tracks on Amazon EKS

Chain Reaction: Uncovering Supply Chain Threats via Azure Application Registrations

Beyond the Backup: The Hidden Dangers of Azure Snapshot Exfiltration

The Silent Data Leak - Exfiltrating AWS Snapshots and Why It’s a Hacker’s Dream

Backdoor Resource Policies: The Dangerous Game of Manipulating Resource Policies

Cloud Confessions: When Azure Storage Becomes the Backdoor

Bridging the Gap: Why Investing in a Robust SOC is Critical for Your Cybersecurity Strategy

AWS User Data Scripts: A Security Nightmare?

Pathways of Privilege: Navigating Secure Access with Microsoft Azure SAS URIs

Finding Your Way Through the AWS Tag Jungle: Simple Steps to Better Cloud Security

SEC Cybersecurity Disclosure Rules Challenge CFOs

Bridging the Insight Gap in Cloud Cybersecurity

Transforming Cyber Threat Intelligence in the Cloud

Neutralizing Nesting Threats During Dwell Time

CIRA: Bridging the Gap between SIEM and SOAR

Airiam Partners With Cyngular Security to Revolutionize Cloud Incident Response and Cyber Resilience

The Triple-Win: Streamlining Cybersecurity for Superior Service

The Power of Timing

Addressing the Menace of Nesting Threats in Cybersecurity

See these attacks stopped in real time