Techniques
Sample rules
Azure AKS Kubernetes Events Deleted
- source: elastic
- technicques:
- T1070
Description
Detects an identity deleting Kubernetes events on AKS (Azure Kubernetes Service), excluding known AKS control-plane and platform identities. Adversaries delete events (individually or in bulk via deletecollection) to remove evidence of pod creation, exec, or scheduling activity and impair incident response after operating in the cluster. Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token wiping events is not excluded.
Detection logic
data_stream.dataset:azure.platformlogs and
event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
azure.platformlogs.properties.log.stage:"ResponseComplete" and
azure.platformlogs.properties.log.objectRef.resource:"events" and
azure.platformlogs.properties.log.verb:("delete" or "deletecollection") and
not azure.platformlogs.properties.log.user.username:(
system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
system\:serviceaccount\:kube-system\:*
)