Azure Kubernetes Event Deletion in Activity Logs

Identifies Azure Activity Log entries where Kubernetes event records are deleted for connected clusters.

FreeUnreviewedSigmamediumv1

azure-kubernetes-event-deletion-in-activity-logs-225d8b09

title: Azure Kubernetes Event Deletion in Activity Logs
id: 2164d619-e727-44df-9fe3-e8aff1724257
status: test
description: This rule flags Azure Activity Log events where Kubernetes connected cluster K8S.io events are deleted. Attackers may delete Kubernetes events to reduce forensic visibility and interfere with monitoring. The detection relies on the Activity Log operationName value matching the specific delete operation for EVENTS.K8S.IO/EVENTS.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-08-23
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE
  condition: selection
falsepositives:
  - Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 225d8b09-e714-479c-a0e4-55e6f29adf35
    type: derived

What it detects

This rule flags Azure Activity Log events where Kubernetes connected cluster K8S.io events are deleted. Attackers may delete Kubernetes events to reduce forensic visibility and interfere with monitoring. The detection relies on the Activity Log operationName value matching the specific delete operation for EVENTS.K8S.IO/EVENTS.

Known false positives

Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.