AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)

title: AWS EKS Cluster CreateCluster or DeleteCluster Events (CloudTrail)
id: cb896138-fb1d-45ea-920b-f3bbbdb47a93
status: test
description: This rule identifies AWS CloudTrail events where an Amazon EKS cluster is created or deleted via the eks.amazonaws.com API. Attackers can use these control-plane actions to impact availability by introducing unauthorized infrastructure or removing existing clusters. Detection relies on CloudTrail telemetry containing eventSource and eventName values for CreateCluster and DeleteCluster, allowing correlation to the initiating identity in the recorded event.
references:
  - https://any-api.com/amazonaws_com/eks/docs/API_Description
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml
author: Austin Songer, Huntrule Team
date: 2021-08-16
modified: 2022-10-09
tags:
  - attack.impact
  - attack.t1485
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventSource: eks.amazonaws.com
    eventName:
      - CreateCluster
      - DeleteCluster
  condition: selection
falsepositives:
  - EKS Cluster being created or deleted may be performed by a system administrator.
  - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
  - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: low
license: DRL-1.1
related:
  - id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0
    type: derived