Attackers are using clouds to attack. Adversaries are learning how to co-opt resources and networks for crime and profit. This session will demonstrate how to detect compromised cloud infrastructure using cloud audit logs provided by the big three cloud providers. By unlocking the full potential of cloud network and API access logs, security operations can thrive in a multi-cloud environment.