Kubernetes Deployment Deleted via Kubernetes API Audit Logs
Alerts when Kubernetes audit logs show a delete action against deployments.
FreeReviewedSigma · Low · v5
- Product
- kubernetes
- Category
- application
- Author
- Leo Tsaousis (@laripping) (SigmaHQ), DRL 1.1
- Published
- 2024-03-26
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies Kubernetes API audit events where a delete operation targets the deployments resource in a cluster. Deleting deployments can disrupt workloads and is a common step in impact-driven activity. Detection relies on Kubernetes audit log records capturing the request verb and the affected object reference.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
kubernetes-deployment-deleted-via-audit-logs-40967487
title: Kubernetes Deployment Deleted via Kubernetes API Audit Logs
id: ae4e4eff-9804-42fb-8100-ae12bee9e885
status: test
description: This rule identifies Kubernetes API audit events where a delete operation targets the deployments resource in a cluster. Deleting deployments can disrupt workloads and is a common step in impact-driven activity. Detection relies on Kubernetes audit log records capturing the request verb and the affected object reference.
references:
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml
author: Leo Tsaousis (@laripping), Huntrule Team
date: 2024-03-26
tags:
- attack.t1498
- attack.impact
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: delete
objectRef.resource: deployments
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 40967487-139b-4811-81d9-c9767a92aa5a
type: derived