administrators may delete kubernetes event objects during routine troubleshooting or cleanup. confirm the actor, scope, and timing before treating the activity as malicious.

t1070
aws
elastic

Techniques

T1070

Sample rules

AWS EKS Events Deleted

source: elastic
technicques:
- T1070

Description

This rule detects the deletion of Kubernetes events, which can indicate an attempt to cover up malicious activity or misconfigurations. Adversaries may delete events to remove traces of their actions, making it harder for defenders to investigate and respond to incidents.

Detection logic

data_stream.dataset:"aws.eks_audit" and
aws.eks.audit.verb:("delete" or "deletecollection") and
aws.eks.audit.objectRef.resource:"events" and
aws.eks.audit.stage:"ResponseComplete" and
not user.name:"system:serviceaccount:kube-system:namespace-controller"