Azure AKS Kubernetes Events Deleted

  1[metadata]
  2creation_date = "2026/07/09"
  3integration = ["azure"]
  4maturity = "production"
  5updated_date = "2026/07/09"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects an identity deleting Kubernetes events on AKS (Azure Kubernetes Service), excluding known AKS control-plane and
 11platform identities. Adversaries delete events (individually or in bulk via deletecollection) to remove evidence of pod
 12creation, exec, or scheduling activity and impair incident response after operating in the cluster. Coverage includes
 13workload service accounts (system:serviceaccount:*), so a compromised in-cluster token wiping events is not excluded.
 14"""
 15false_positives = [
 16    """
 17    Event cleanup jobs or platform tooling may bulk-delete events. Baseline the responsible identities and exclude
 18    verified automation after review.
 19    """,
 20]
 21from = "now-9m"
 22index = ["logs-azure.platformlogs-*"]
 23language = "kuery"
 24license = "Elastic License v2"
 25name = "Azure AKS Kubernetes Events Deleted"
 26note = """## Triage and analysis
 27
 28### Investigating Azure AKS Kubernetes Events Deleted
 29
 30AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
 31operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. Kubernetes events record pod
 32scheduling, image pulls, and other cluster activity. Deleting them (individually with `delete`, or in bulk with
 33`deletecollection`) outside of known AKS control-plane and platform identities is a defense-evasion step to erase
 34evidence of prior actions.
 35
 36### Possible investigation steps
 37
 38- Identify the acting identity in `azure.platformlogs.properties.log.user.username` (and its groups in
 39  `azure.platformlogs.properties.log.user.groups`) and whether it should delete events. A username of `masterclient`
 40  (`system:masters`) is the AKS local cluster-admin certificate; workload service accounts
 41  (`system:serviceaccount:<ns>:<sa>`) deleting events are the higher-concern case.
 42- Determine the scale from `azure.platformlogs.properties.log.verb`: `deletecollection` is a bulk wipe (e.g.
 43  `kubectl delete events --all`), while `delete` removes a single event. Review the target scope in
 44  `azure.platformlogs.properties.log.objectRef.namespace` / `azure.platformlogs.properties.log.objectRef.name`.
 45- Inspect `azure.platformlogs.properties.log.userAgent` to distinguish interactive tooling (`kubectl`) from automation
 46  or custom clients, and pivot on `azure.platformlogs.properties.log.sourceIPs` for the activity the deletion may be
 47  concealing (pod creation, exec, RBAC changes).
 48- Reconstruct the timeline from surviving kube-audit records, which persist independently of the deleted Kubernetes
 49  events.
 50
 51### False positive analysis
 52
 53- Event cleanup jobs or platform tooling may bulk-delete events; baseline the responsible identities and exclude
 54  verified automation. If a platform control-plane identity (for example an event TTL/garbage-collection component)
 55  surfaces, add that specific identity to the exclusion rather than re-broadening to all `system:*`, which would blind
 56  the rule to compromised workload service accounts.
 57
 58### Response and remediation
 59
 60- If unauthorized, revoke the acting identity's tokens and review the RBAC that permitted event deletion.
 61- Use kube-audit history to reconstruct the concealed activity and scope the incident.
 62- Collect kube-audit and identity artifacts per incident response procedures.
 63"""
 64references = [
 65    "https://kubernetes.io/docs/reference/kubernetes-api/cluster-resources/event-v1/",
 66    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
 67    "https://learn.microsoft.com/en-us/azure/aks/monitor-aks",
 68    "https://kubenomicon.com/Defense_evasion/Delete_events.html"
 69]
 70risk_score = 47
 71rule_id = "9bc14983-fabc-4a3e-896d-3632a902f17c"
 72setup = """
 73The Azure Fleet integration collecting AKS diagnostic logs forwarded through Event Hub into the `azure.platformlogs`
 74data stream is required for this rule. Enable either the `kube-audit` or the `kube-audit-admin` log category (Microsoft
 75recommends `kube-audit-admin` alone to reduce volume, as it only drops read-only get/list events). Event deletions are
 76mutating operations recorded in both categories with the same `auditID`, so clusters that enable both categories may
 77generate two alerts per deletion.
 78"""
 79severity = "medium"
 80tags = [
 81    "Domain: Cloud",
 82    "Domain: Kubernetes",
 83    "Data Source: Azure",
 84    "Data Source: Azure Platform Logs",
 85    "Data Source: Kubernetes",
 86    "Use Case: Threat Detection",
 87    "Tactic: Defense Evasion",
 88    "Resources: Investigation Guide",
 89]
 90timestamp_override = "event.ingested"
 91type = "query"
 92
 93query = '''
 94data_stream.dataset:azure.platformlogs and
 95  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
 96  azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
 97  azure.platformlogs.properties.log.stage:"ResponseComplete" and
 98  azure.platformlogs.properties.log.objectRef.resource:"events" and
 99  azure.platformlogs.properties.log.verb:("delete" or "deletecollection") and
100  not azure.platformlogs.properties.log.user.username:(
101    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
102    system\:serviceaccount\:kube-system\:*
103  )
104'''
105
106
107[[rule.threat]]
108framework = "MITRE ATT&CK"
109[[rule.threat.technique]]
110id = "T1070"
111name = "Indicator Removal"
112reference = "https://attack.mitre.org/techniques/T1070/"
113
114
115[rule.threat.tactic]
116id = "TA0005"
117name = "Defense Evasion"
118reference = "https://attack.mitre.org/tactics/TA0005/"
119
120[rule.investigation_fields]
121field_names = [
122    "@timestamp",
123    "event.action",
124    "azure.platformlogs.category",
125    "azure.platformlogs.properties.log.verb",
126    "azure.platformlogs.properties.log.user.username",
127    "azure.platformlogs.properties.log.user.groups",
128    "azure.platformlogs.properties.log.userAgent",
129    "azure.platformlogs.properties.log.sourceIPs",
130    "azure.platformlogs.properties.log.objectRef.namespace",
131    "azure.platformlogs.properties.log.objectRef.name",
132    "azure.platformlogs.properties.log.requestURI",
133    "azure.platformlogs.properties.log.responseStatus.code",
134]