Depends on the company. Stuff like Crowdstrike and the more advanced Defender service spot this sort of thing.

SSH is probably the best one, especially as you can usually get policy exceptions to access cloud resources.