Azure Kubernetes Events Deleted via Activity Logs
Identifies Azure Activity Log entries where Kubernetes event records are deleted for connected clusters.
FreeReviewedSigma · Medium · v5
- Product
- azure
- Service
- activitylogs
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-07-24
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags DELETE operations for Kubernetes events exposed through Azure activity logs. Attackers may delete Kubernetes events to reduce visibility and hinder investigation. Detection relies on telemetry that records the specific operation name for Azure Kubernetes events deletion, allowing correlation to the actor and affected resources.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
- github.comhttps://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
azure-kubernetes-event-deletion-in-activity-logs-225d8b09
title: Azure Kubernetes Events Deleted via Activity Logs
id: 2164d619-e727-44df-9fe3-e8aff1724257
status: test
description: This rule flags DELETE operations for Kubernetes events exposed through Azure activity logs. Attackers may delete Kubernetes events to reduce visibility and hinder investigation. Detection relies on telemetry that records the specific operation name for Azure Kubernetes events deletion, allowing correlation to the actor and affected resources.
references:
- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
- https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-07-24
modified: 2022-08-23
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: azure
service: activitylogs
detection:
selection:
operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE
condition: selection
falsepositives:
- Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: 225d8b09-e714-479c-a0e4-55e6f29adf35
type: derived