Azure Arc-enabled Kubernetes Azure-Microsoft.Kubernetes
| operationName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all for Azure-Microsoft.Kubernetes rules that match the resource provider but no specific operation. | N | N |
| Microsoft.Kubernetes/ | Deletes connectedClusters | N | Y |
| Microsoft.Kubernetes/ | List clusterUser credential | N | Y |
| Microsoft.Kubernetes/ | List clusterUser credential(preview) | N | N |
| Microsoft.Kubernetes/ | Writes connectedClusters | N | Y |
| Microsoft.Kubernetes/ | Write Operation Statuses | N | N |
| Microsoft.Kubernetes/ | Registers Subscription with Microsoft.Kubernetes resource provider | N | N |
| Microsoft.Kubernetes/ | Un-Registers Subscription with Microsoft.Kubernetes resource provider | N | N |
any: Azure Arc-enabled Kubernetes (catch-all)
#Description
Catch-all for Azure-Microsoft.Kubernetes rules that match the resource provider but no specific operation.
Microsoft.Kubernetes/connectedClusters/Delete
#Description
Deletes connectedClusters
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1485, T1489, T1496↳ also matches Microsoft.Kubernetes/connectedClusters/Write
Microsoft.Kubernetes/connectedClusters/listClusterUserCredential/action
#Description
List clusterUser credential
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Elastic #
listClusterUserCredential action retrieves credentials for the Arc Cluster Connect proxy, enabling kubectl access through the Azure ARM API. An adversary using stolen service principal credentials will typically call this operation from infrastructure not previously seen for that SP. By tracking the combination of caller identity and source IP, this rule avoids false positives from backend services and CI/CD pipelines that rotate IPs but maintain consistent identity-to-IP patterns over time.T1078, T1078.004, T1552, T1552.007
Microsoft.Kubernetes/connectedClusters/listClusterUserCredentials/action
#Description
List clusterUser credential(preview)
Microsoft.Kubernetes/connectedClusters/Write
#Description
Writes connectedClusters
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Sigma #
T1485, T1489, T1496↳ also matches Microsoft.Kubernetes/connectedClusters/Delete
Microsoft.Kubernetes/locations/operationstatuses/write
#Description
Write Operation Statuses
Microsoft.Kubernetes/register/action
#Description
Registers Subscription with Microsoft.Kubernetes resource provider
Microsoft.Kubernetes/unregister/action
#Description
Un-Registers Subscription with Microsoft.Kubernetes resource provider