Azure Arc-enabled Kubernetes
| operationName | Description | Sample | Rule |
|---|---|---|---|
| Microsoft.Kubernetes/ | Deletes connectedClusters | N | Y |
| Microsoft.Kubernetes/ | List clusterUser credential | N | Y |
| Microsoft.Kubernetes/ | List clusterUser credential(preview) | N | N |
| Microsoft.Kubernetes/ | Writes connectedClusters | N | Y |
| Microsoft.Kubernetes/ | Write Operation Statuses | N | N |
| Microsoft.Kubernetes/ | Registers Subscription with Microsoft.Kubernetes resource provider | N | N |
| Microsoft.Kubernetes/ | Un-Registers Subscription with Microsoft.Kubernetes resource provider | N | N |
Microsoft.Kubernetes/connectedClusters/Delete
#Description
Deletes connectedClusters
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
OperationNameValue | 1 detection rule | Sigma |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Sigma #
T1485, T1489, T1496↳ also matches Microsoft.Kubernetes/connectedClusters/Write
Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action
#Description
List clusterUser credential
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
ActivityStatusValue | 1 detection rule | Elastic |
OperationNameValue | 1 detection rule | Elastic |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Elastic #
listClusterUserCredential action retrieves credentials for the Arc Cluster Connect proxy, enabling kubectl access through the Azure ARM API. An adversary using stolen service principal credentials will typically call this operation from infrastructure not previously seen for that SP. By tracking the combination of caller identity and source IP, this rule avoids false positives from backend services and CI/CD pipelines that rotate IPs but maintain consistent identity-to-IP patterns over time.T1078, T1078.004, T1552, T1552.007
Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action
#Description
List clusterUser credential(preview)
Microsoft.Kubernetes/connectedClusters/Write
#Description
Writes connectedClusters
Detection Fields #
Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete schema for this catalog entry.
| Name | Rules | Vendors |
|---|---|---|
OperationNameValue | 1 detection rule | Sigma |
Detection Rules #
Full rule details for this catalog entry, including ATT&CK technique mappings and native queries →Sigma #
T1485, T1489, T1496↳ also matches Microsoft.Kubernetes/connectedClusters/Delete
Microsoft.Kubernetes/locations/operationstatuses/write
#Description
Write Operation Statuses
Microsoft.Kubernetes/register/action
#Description
Registers Subscription with Microsoft.Kubernetes resource provider
Microsoft.Kubernetes/unregister/action
#Description
Un-Registers Subscription with Microsoft.Kubernetes resource provider
any: Azure Arc-enabled Kubernetes (catch-all)
#Scope grouping: This repository-authored catalog entry represents a broad attribution scope, not a distinct emitted event or operation. Any sample below is a representative record from that scope; attached rules, if any, are listed separately.
Description
Catch-all for Azure-Microsoft.Kubernetes rules that match the resource provider but no specific operation.