Kubernetes Events Deleted

Title: Kubernetes Events Deleted
Status: test
Description:Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.
References:
  -https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1070'

Logsource:

• category: application
• product: kubernetes
• service: audit

Detection:
  selection:
    verb: 'delete'
    objectRef.resource: 'events'
  condition:selection
Falsepositives:
  -Unknown
Level: medium