Possible Deployment Deleted From Kubernetes Cluster (via application)

title: Possible Deployment Deleted From Kubernetes Cluster (via application)
id: 34392ac4-3e8e-5431-8b17-acb2e62fae01
status: stable
description: This rule detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive behavior aiming to impact business operations.
references:
    - https://attack.mitre.org/techniques/T1498/
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/
author: Huntrule Team
date: 2026-02-13
tags:
    - attack.t1498
    - attack.impact
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'delete'
        objectRef.resource: 'deployments'
    condition: selection
falsepositives:
    - Unknown
level: low