AWS EKS Cluster CreateCluster or DeleteCluster via CloudTrail

Alerts on CloudTrail API activity indicating an EKS cluster was created or deleted.

FreeUnreviewedSigmalowv1

aws-eks-cluster-createcluster-or-deletecluster-via-cloudtrail-33d50d03

title: AWS EKS Cluster CreateCluster or DeleteCluster via CloudTrail
id: cb896138-fb1d-45ea-920b-f3bbbdb47a93
status: test
description: This rule flags AWS CloudTrail events where an Amazon EKS cluster is created (CreateCluster) or deleted (DeleteCluster). Attackers may use EKS infrastructure changes to disrupt workloads, destroy cluster state, or prepare for subsequent access and impact. The detection relies on CloudTrail telemetry capturing the eventSource and eventName values for EKS API calls.
references:
  - https://any-api.com/amazonaws_com/eks/docs/API_Description
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-16
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1485
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: eks.amazonaws.com
    eventName:
      - CreateCluster
      - DeleteCluster
  condition: selection
falsepositives:
  - EKS Cluster being created or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0
    type: derived

What it detects

This rule flags AWS CloudTrail events where an Amazon EKS cluster is created (CreateCluster) or deleted (DeleteCluster). Attackers may use EKS infrastructure changes to disrupt workloads, destroy cluster state, or prepare for subsequent access and impact. The detection relies on CloudTrail telemetry capturing the eventSource and eventName values for EKS API calls.

Known false positives

EKS Cluster being created or deleted may be performed by a system administrator.
Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.