CrowdStrike Expands Falcon Adversary OverWatch Threat Hunting Across AI and Google Cloud

As adversaries broaden their operations across cloud environments, identities, SaaS applications, and AI systems, security teams need threat hunting that can keep up. Suspicious activity in one environment may be part of a larger intrusion spanning multiple domains, making it increasingly important to connect signals across the attack surface.

To expand detection coverage across the widening attack surface, CrowdStrike Falcon® Adversary OverWatch™ threat hunting has added two key capabilities: 24/7 managed hunting for AI applications and autonomous agent activity through CrowdStrike Falcon® Guardian, and deeper, telemetry-driven hunting for Google Cloud.

This expansion builds on our recent launch of Falcon Adversary OverWatch Cross-Domain, which extends 24/7 managed threat hunting across identity, cloud, AI agent activity, SaaS applications, and third-party data. This equips CrowdStrike OverWatch threat hunters with broader visibility to uncover adversary activity across the CrowdStrike Falcon® platform, and eliminates the need for customers to acquire separate threat hunting SKUs for each eligible module or domain.

How AI Can Become Part of a Cross-Domain Intrusion

To understand the potential impact of AI on cross-domain activity, consider an intrusion that begins with a compromised identity provider session following a phishing attack. The adversary could register a rogue Quick Emulator (QEMU) device with the organization’s multifactor authentication (MFA) solution, gain persistent access, and pivot into connected SaaS applications.

After gaining access to Claude through the compromised identity, the adversary could use the LLM to enumerate connected applications and local files, generate scripts to collect credentials, and scan skill repositories and agentic infrastructure. The intrusion could culminate in a command-and-control (C2) backdoor connecting a compromised endpoint to adversary infrastructure.

Viewed independently, the identity compromise, suspicious AI interactions, and endpoint execution may appear unrelated. Together, they reveal how an intrusion could span multiple environments, underscoring why CrowdStrike OverWatch hunters need cross-domain visibility to uncover the full scope of adversary activity.

Extending Threat Hunting and MDR to AI

As organizations increasingly connect AI systems to sensitive data, applications, and infrastructure, adversaries have new opportunities to exploit trusted access and legitimate AI capabilities. According to the CrowdStrike 2026 Threat Hunting Report, AI agents triggered 2.5 times more detection leads than human activity, underscoring how AI-driven activity is increasing the volume and velocity of signals threat hunters must assess.

Falcon Adversary OverWatch Cross-Domain now extends 24/7 proactive threat hunting to AI applications and autonomous agent activity monitored by CrowdStrike Falcon Guardian. By combining Falcon Guardian's runtime context with telemetry across the Falcon platform and frontline adversary intelligence, CrowdStrike OverWatch hunters can uncover manipulation, abuse, and emerging adversary tradecraft that automated detections may miss. This broader context helps hunters connect suspicious AI activity to larger intrusions spanning identities, applications, and infrastructure.

In addition to proactive threat hunting for AI applications and agents, CrowdStrike Falcon® Complete for Falcon Guardian extends 24/7 expert-led managed detection and response (MDR) to AI coding assistants and agents monitored by Falcon Guardian. Specialized analysts investigate malicious prompts, suspicious agent behavior, and threats involving AI tools and skills. Using CrowdStrike Agent Graph, analysts connect AI agent activity with downstream endpoint execution to assess the scope of threats and rapidly contain and remediate confirmed attacks.

Together, Falcon Adversary OverWatch and Falcon Complete bring proactive threat hunting and expert-led response to the AI attack surface.

Going Deeper in Google Cloud

Cloud environments remain a critical part of the modern attack surface. eCrime cloud-conscious activity surged 171% year-over-year as adversaries increasingly used stolen credentials, misconfigurations, and legitimate tools to operate across cloud infrastructure, the CrowdStrike 2026 Threat Hunting Report found.

These attacks can be difficult to uncover because adversaries often blend malicious activity with legitimate administrative operations. Threat hunters need access to detailed cloud telemetry, an understanding of adversary techniques, and the context to connect suspicious events.

CrowdStrike is extending Falcon Adversary OverWatch's advanced threat hunting capabilities to Google Cloud, delivering the same depth and precision of telemetry-driven hunting available in Amazon Web Services (AWS) and Microsoft Azure. By hunting directly on underlying cloud telemetry rather than relying solely on product-generated detections, CrowdStrike OverWatch hunters can identify suspicious activity earlier in the attack chain, including service account misuse, privilege escalation, and signs of lateral movement.

With this expansion, Falcon Adversary OverWatch now delivers consistent, telemetry-driven managed threat hunting across AWS, Azure, and Google Cloud. This helps security teams uncover sophisticated threats across multi-cloud environments without managing separate hunting operations for each cloud.

Broader Hunting Coverage in a Single Offering

Falcon Adversary OverWatch analyzes 7 trillion events daily, surfaces more than 14 million detection leads, and delivers over 36,000 high-fidelity customer notifications each year. Backed by CrowdStrike intelligence on more than 290 tracked adversaries across nation-state, eCrime, and hacktivist groups, CrowdStrike OverWatch hunters know how adversaries operate, the techniques they use, and where to find them.

With proactive AI threat hunting and deeper Google Cloud coverage, CrowdStrike is extending Falcon Adversary OverWatch's visibility across the modern attack surface and connecting suspicious activity across domains to uncover and stop adversaries before they achieve their objectives.

Additional Resources

• Learn more about Falcon Adversary OverWatch.
• Explore CrowdStrike Threat Intelligence and Hunting offerings.
• Download the CrowdStrike 2026 Threat Hunting Report.