Delayed or No Cloud Correlation

While some AVs now offer cloud-based scanning (e.g., Windows Defender Cloud Protection):

1. Not all events are sent for cloud analysis.

2. Offline systems or blocked telemetry prevent updates.

3. Cloud signatures can be bypassed with modified payloads.

Evasion Tip: Block telemetry domains during testing and understand which artifacts are sent to the cloud.