AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)

Alerts on CloudTrail API activity indicating an EKS cluster was created or deleted.

FreeReviewedSigma · Low · v5

Product: aws
Service: cloudtrail
Author: Austin Songer (SigmaHQ), DRL 1.1
Published: 2021-08-16
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1485Data Destruction

What it detects

This rule identifies AWS CloudTrail events where an Amazon EKS cluster is created or deleted via the eks.amazonaws.com API. Attackers can use these control-plane actions to impact availability by introducing unauthorized infrastructure or removing existing clusters. Detection relies on CloudTrail telemetry containing eventSource and eventName values for CreateCluster and DeleteCluster, allowing correlation to the initiating identity in the recorded event.

Reporting behind it

Related detections9 linkedT1485 — drag to rearrange

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

Suspicious Free Space Wipe via cipher.exe

Suspicious sha256sum.exe Execution from Windows Temp Directory

Suspicious Secure Deletion of Free Space via Cipher (via process_creation)

HamsaUpdate Wiper Trigger via F5UPDATER ConfirmDeleteFiles Argument (via process_creation)

Malicious Scheduled Task Deploying DYNOWIPER Payload (via process_creation)

Malicious Mini Shai-Hulud TanStack Destructive rm Killswitch (via process_creation)

Malicious S3 Object Encryption with Customer Provided Key via CopyObject

Malicious Cloud Storage Destruction by Cloud Build Service Account

AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)

Pivot detection · T1485 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-eks-cluster-createcluster-or-deletecluster-via-cloudtrail-33d50d03

title: AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)
id: cb896138-fb1d-45ea-920b-f3bbbdb47a93
status: test
description: This rule identifies AWS CloudTrail events where an Amazon EKS cluster is created or deleted via the eks.amazonaws.com API. Attackers can use these control-plane actions to impact availability by introducing unauthorized infrastructure or removing existing clusters. Detection relies on CloudTrail telemetry containing eventSource and eventName values for CreateCluster and DeleteCluster, allowing correlation to the initiating identity in the recorded event.
references:
  - https://any-api.com/amazonaws_com/eks/docs/API_Description
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-16
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1485
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: eks.amazonaws.com
    eventName:
      - CreateCluster
      - DeleteCluster
  condition: selection
falsepositives:
  - EKS Cluster being created or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL