AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)

Alerts on CloudTrail API activity indicating an EKS cluster was created or deleted.

FreeReviewedSigma · Low · v5

Product: aws
Service: cloudtrail
Author: Austin Songer (SigmaHQ), DRL 1.1
Published: 2021-08-16
Updated: 2026-07-31

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
- T1485Data Destruction

What it detects

This rule identifies AWS CloudTrail events where an Amazon EKS cluster is created or deleted via the eks.amazonaws.com API. Attackers can use these control-plane actions to impact availability by introducing unauthorized infrastructure or removing existing clusters. Detection relies on CloudTrail telemetry containing eventSource and eventName values for CreateCluster and DeleteCluster, allowing correlation to the initiating identity in the recorded event.

Reporting behind it

Related detections9 linkedT1485 — drag to rearrange

Malicious JADEPUFFER Ransom Database Table Manipulation

Suspicious Self-Deleting Batch Script Execution Consistent with Agonizing Serpens Wiper Cleanup

Malicious Mass Device Wipe via Intune Remote Actions (via m365)

Malicious S3 Bucket Deletion During Bling Libra Extortion

Malicious DYNOWIPER PowerShell Loader Execution (via ps_script)

Suspicious S3 Lifecycle Policy Set for Rapid Object Deletion

Malicious PathWiper Loader Script Execution from Windows Temp via WScript

Suspicious Free Space Wipe via cipher.exe

Suspicious sha256sum.exe Execution from Windows Temp Directory

AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)

Pivot detection · T1485 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

aws-eks-cluster-createcluster-or-deletecluster-via-cloudtrail-33d50d03

title: AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)
id: cb896138-fb1d-45ea-920b-f3bbbdb47a93
status: test
description: This rule identifies AWS CloudTrail events where an Amazon EKS cluster is created or deleted via the eks.amazonaws.com API. Attackers can use these control-plane actions to impact availability by introducing unauthorized infrastructure or removing existing clusters. Detection relies on CloudTrail telemetry containing eventSource and eventName values for CreateCluster and DeleteCluster, allowing correlation to the initiating identity in the recorded event.
references:
  - https://any-api.com/amazonaws_com/eks/docs/API_Description
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-16
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1485
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: eks.amazonaws.com
    eventName:
      - CreateCluster
      - DeleteCluster
  condition: selection
falsepositives:
  - EKS Cluster being created or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL