Sigma rule: Azure Kubernetes Events Deleted

Rule

Title

Azure Kubernetes Events Deleted

Status

test

Level

medium

Author

Austin Songer @austinsonger

Date

2021-07-24

Modified

2022-08-23

File

rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.

Log source

product

azure

service

activitylogs

Detection

selection:
    operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE
condition: selection

False positives (as the rule lists them)

• Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.defense-impairment
• attack.t1685

MITRE ATT&CK ids this rule names

• T1685

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
• https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml