Kubernetes Deployment Deleted via Audit Logs

Alerts when Kubernetes audit logs show a delete action against deployments.

FreeUnreviewedSigmalowv1

kubernetes-deployment-deleted-via-audit-logs-40967487

title: Kubernetes Deployment Deleted via Audit Logs
id: ae4e4eff-9804-42fb-8100-ae12bee9e885
status: test
description: This rule flags Kubernetes API audit events where a delete operation targets the deployments resource. Removing a deployment can disrupt services or deployment workflows, making it relevant to availability and impact-focused activity. It relies on Kubernetes audit telemetry capturing the verb and the targeted resource reference.
references:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
  - attack.t1498
  - attack.impact
logsource:
  category: application
  product: kubernetes
  service: audit
detection:
  selection:
    verb: delete
    objectRef.resource: deployments
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 40967487-139b-4811-81d9-c9767a92aa5a
    type: derived

What it detects

This rule flags Kubernetes API audit events where a delete operation targets the deployments resource. Removing a deployment can disrupt services or deployment workflows, making it relevant to availability and impact-focused activity. It relies on Kubernetes audit telemetry capturing the verb and the targeted resource reference.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.