Suspicious Removal of Azure Kubernetes Events (via activitylogs)

title: Suspicious Removal of Azure Kubernetes Events (via activitylogs)
id: 46a6d673-f50e-5706-86a1-39cd22ff9836
status: stable
description: This rule detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes seeking to evade detection.
references:
    - https://attack.mitre.org/techniques/T1685/
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
    - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml
author: Huntrule Team
date: 2026-03-05
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE
    condition: selection
falsepositives:
    - Unknown
level: medium