detection.wiki

Events

OperationDescriptionSampleRule
get-eventsReads a single Kubernetes Event (a routine status or warning record). Elastic's new-terms user-agent rule alerts on a not-previously-seen identity fetching it.YN
list-eventsLists Events across a namespace, a low-cost way to reconstruct recent cluster activity. Elastic's new-terms user-agent rule covers a first-seen client doing this.YN
watch-eventsOpens a long-lived watch on Event creation, effectively tailing the cluster's activity log. Elastic's new-terms user-agent rule flags a first-seen client doing this.YN
create-eventsYN
update-eventsYN
patch-eventsModifies an existing Event record. Unlike deleting an Event (a dedicated anti-forensics detection), patching one can quietly alter its recorded message or count.YN
delete-eventsEvents deleted (defense evasion: clearing audit trail / event history).YY
deletecollection-eventsYY
any-eventsSynthetic aggregation for rules that filter the events resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.NY

get events

#
Resource
events

Description

Reads a single Kubernetes Event (a routine status or warning record). Elastic's new-terms user-agent rule alerts on a not-previously-seen identity fetching it.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/dw-harn/events/dw-harn-events",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "events",
    "namespace": "dw-harn",
    "name": "dw-harn-events",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:47:04.167980Z",
  "stageTimestamp": "2026-07-02T22:47:04.169881Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

list events

#
Resource
events

Description

Lists Events across a namespace, a low-cost way to reconstruct recent cluster activity. Elastic's new-terms user-agent rule covers a first-seen client doing this.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/dw-harn/events?fieldSelector=metadata.name%3Ddw-harn-events",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "events",
    "namespace": "dw-harn",
    "name": "dw-harn-events",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:47:07.701926Z",
  "stageTimestamp": "2026-07-02T22:47:07.704129Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

watch events

#
Resource
events

Description

Opens a long-lived watch on Event creation, effectively tailing the cluster's activity log. Elastic's new-terms user-agent rule flags a first-seen client doing this.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/dw-harn/events?resourceVersion=1033&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "events",
    "namespace": "dw-harn",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:47:04.329871Z",
  "stageTimestamp": "2026-07-02T22:47:07.344565Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

create events

#
Resource
events

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "96a0f5db-6839-49a3-8d05-ade7c2cbe9a3",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/default/events",
  "verb": "create",
  "user": {
    "username": "system:node:ip-192-168-39-110.us-west-2.compute.internal",
    "uid": "aws-iam-authenticator:591511147606:AROAYTOGP2RLF3VUCKG6C",
    "groups": [
      "system:bootstrappers",
      "system:nodes",
      "system:authenticated"
    ]
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubelet/v1.27.7 (linux/amd64) kubernetes/bef43c9",
  "objectRef": {
    "resource": "events",
    "namespace": "default",
    "name": "alpine.179deef411c7c67e",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "Event",
    "apiVersion": "v1",
    "metadata": {
      "name": "alpine.179deef411c7c67e",
      "namespace": "default",
      "creationTimestamp": null
    },
    "involvedObject": {
      "kind": "Pod",
      "namespace": "default",
      "name": "alpine",
      "uid": "e1ccaa7d-3b12-4bbd-a662-427b01217947",
      "apiVersion": "v1",
      "resourceVersion": "857090",
      "fieldPath": "spec.containers{alpine}"
    },
    "reason": "Pulling",
    "message": "Pulling image \"alpine\"",
    "source": {
      "component": "kubelet",
      "host": "ip-192-168-39-110.us-west-2.compute.internal"
    },
    "firstTimestamp": "2023-12-05T12:22:46Z",
    "lastTimestamp": "2023-12-05T12:22:46Z",
    "count": 1,
    "type": "Normal",
    "eventTime": null,
    "reportingComponent": "kubelet",
    "reportingInstance": "ip-192-168-39-110.us-west-2.compute.internal"
  },
  "responseObject": {
    "kind": "Event",
    "apiVersion": "v1",
    "metadata": {
      "name": "alpine.179deef411c7c67e",
      "namespace": "default",
      "uid": "a9d00852-ede3-4bb4-9672-014ac14fcc1e",
      "resourceVersion": "857093",
      "creationTimestamp": "2023-12-05T12:22:46Z"
    },
    "involvedObject": {
      "kind": "Pod",
      "namespace": "default",
      "name": "alpine",
      "uid": "e1ccaa7d-3b12-4bbd-a662-427b01217947",
      "apiVersion": "v1",
      "resourceVersion": "857090",
      "fieldPath": "spec.containers{alpine}"
    },
    "reason": "Pulling",
    "message": "Pulling image \"alpine\"",
    "source": {
      "component": "kubelet",
      "host": "ip-192-168-39-110.us-west-2.compute.internal"
    },
    "firstTimestamp": "2023-12-05T12:22:46Z",
    "lastTimestamp": "2023-12-05T12:22:46Z",
    "count": 1,
    "type": "Normal",
    "eventTime": null,
    "reportingComponent": "kubelet",
    "reportingInstance": "ip-192-168-39-110.us-west-2.compute.internal"
  },
  "requestReceivedTimestamp": "2023-12-05T12:22:46.254365Z",
  "stageTimestamp": "2023-12-05T12:22:46.262400Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": ""
  }
}

References #

update events

#
Resource
events

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/dw-harn/events/dw-harn-events?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "events",
    "namespace": "dw-harn",
    "name": "dw-harn-events",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiVersion": "v1",
    "resourceVersion": "1041"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "Event",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-events",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1041",
      "creationTimestamp": "2026-07-02T22:47:04Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "involvedObject": {
      "kind": "Pod",
      "namespace": "dw-harn",
      "name": "dw-harn-event-target",
      "apiVersion": "v1"
    },
    "reason": "DwHarnProbe",
    "message": "detection.wiki harness synthetic event",
    "source": {
      "component": "dw-harn"
    },
    "firstTimestamp": "2024-01-01T00:00:00Z",
    "lastTimestamp": "2024-01-01T00:00:00Z",
    "count": 1,
    "type": "Normal",
    "eventTime": null,
    "reportingComponent": "",
    "reportingInstance": ""
  },
  "responseObject": {
    "kind": "Event",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-events",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1041",
      "creationTimestamp": "2026-07-02T22:47:04Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "involvedObject": {
      "kind": "Pod",
      "namespace": "dw-harn",
      "name": "dw-harn-event-target",
      "apiVersion": "v1"
    },
    "reason": "DwHarnProbe",
    "message": "detection.wiki harness synthetic event",
    "source": {
      "component": "dw-harn"
    },
    "firstTimestamp": "2024-01-01T00:00:00Z",
    "lastTimestamp": "2024-01-01T00:00:00Z",
    "count": 1,
    "type": "Normal",
    "eventTime": null,
    "reportingComponent": "",
    "reportingInstance": ""
  },
  "requestReceivedTimestamp": "2026-07-02T22:47:07.625825Z",
  "stageTimestamp": "2026-07-02T22:47:07.628589Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

patch events

#
Resource
events

Description

Modifies an existing Event record. Unlike deleting an Event (a dedicated anti-forensics detection), patching one can quietly alter its recorded message or count.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/dw-harn/events/dw-harn-events?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "events",
    "namespace": "dw-harn",
    "name": "dw-harn-events",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "Event",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-events",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1041",
      "creationTimestamp": "2026-07-02T22:47:04Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "involvedObject": {
      "kind": "Pod",
      "namespace": "dw-harn",
      "name": "dw-harn-event-target",
      "apiVersion": "v1"
    },
    "reason": "DwHarnProbe",
    "message": "detection.wiki harness synthetic event",
    "source": {
      "component": "dw-harn"
    },
    "firstTimestamp": "2024-01-01T00:00:00Z",
    "lastTimestamp": "2024-01-01T00:00:00Z",
    "count": 1,
    "type": "Normal",
    "eventTime": null,
    "reportingComponent": "",
    "reportingInstance": ""
  },
  "requestReceivedTimestamp": "2026-07-02T22:47:07.417915Z",
  "stageTimestamp": "2026-07-02T22:47:07.422315Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

delete events

#
Resource
events

Description

Events deleted (defense evasion: clearing audit trail / event history).

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/dw-harn/events/dw-harn-events",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "events",
    "namespace": "dw-harn",
    "name": "dw-harn-events",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-events",
      "kind": "events",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-events",
      "kind": "events",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:47:07.705576Z",
  "stageTimestamp": "2026-07-02T22:47:07.717419Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
azure.platformlogs.properties.log.verb (elastic rule field)indelete1 ruleelastic
kubernetes.audit.stage (elastic rule field)eqResponseComplete1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • Azure AKS Kubernetes Events Deleted source medium: Detects an identity deleting Kubernetes events on AKS (Azure Kubernetes Service), excluding known AKS control-plane and platform identities. Adversaries delete events (individually or in bulk via deletecollection) to remove evidence of pod creation, exec, or scheduling activity and impair incident response after operating in the cluster. Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token wiping events is not excluded.T1070↳ also matches deletecollection-events: deletecollection events
    Investigation guide

    Triage and analysis#

    Investigating Azure AKS Kubernetes Events Deleted#

    AKS kube-audit events are carried under the flattened azure.platformlogs.properties.log.* subtree and share the ARM operation event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read. Kubernetes events record pod scheduling, image pulls, and other cluster activity. Deleting them (individually with delete, or in bulk with deletecollection) outside of known AKS control-plane and platform identities is a defense-evasion step to erase evidence of prior actions.

    Possible investigation steps#

    • Identify the acting identity in azure.platformlogs.properties.log.user.username (and its groups in azure.platformlogs.properties.log.user.groups) and whether it should delete events. A username of masterclient (system:masters) is the AKS local cluster-admin certificate; workload service accounts (system:serviceaccount:<ns>:<sa>) deleting events are the higher-concern case.
    • Determine the scale from azure.platformlogs.properties.log.verb: deletecollection is a bulk wipe (e.g. kubectl delete events --all), while delete removes a single event. Review the target scope in azure.platformlogs.properties.log.objectRef.namespace / azure.platformlogs.properties.log.objectRef.name.
    • Inspect azure.platformlogs.properties.log.userAgent to distinguish interactive tooling (kubectl) from automation or custom clients, and pivot on azure.platformlogs.properties.log.sourceIPs for the activity the deletion may be concealing (pod creation, exec, RBAC changes).
    • Reconstruct the timeline from surviving kube-audit records, which persist independently of the deleted Kubernetes events.

    False positive analysis#

    • Event cleanup jobs or platform tooling may bulk-delete events; baseline the responsible identities and exclude verified automation. If a platform control-plane identity (for example an event TTL/garbage-collection component) surfaces, add that specific identity to the exclusion rather than re-broadening to all system:*, which would blind the rule to compromised workload service accounts.

    Response and remediation#

    • If unauthorized, revoke the acting identity's tokens and review the RBAC that permitted event deletion.
    • Use kube-audit history to reconstruct the concealed activity and scope the incident.
    • Collect kube-audit and identity artifacts per incident response procedures.

References #

deletecollection events

#
Resource
events

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/dw-harn/events?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "events",
    "namespace": "dw-harn",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "EventList",
    "apiVersion": "v1",
    "metadata": {
      "resourceVersion": "1040"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-events",
          "namespace": "dw-harn",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1039",
          "creationTimestamp": "2026-07-02T23:13:54Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "involvedObject": {
          "kind": "Pod",
          "namespace": "dw-harn",
          "name": "dw-harn-event-target",
          "apiVersion": "v1"
        },
        "reason": "DwHarnProbe",
        "message": "detection.wiki harness synthetic event",
        "source": {
          "component": "dw-harn"
        },
        "firstTimestamp": "2024-01-01T00:00:00Z",
        "lastTimestamp": "2024-01-01T00:00:00Z",
        "count": 1,
        "type": "Normal",
        "eventTime": null,
        "reportingComponent": "",
        "reportingInstance": ""
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:13:58.215865Z",
  "stageTimestamp": "2026-07-02T23:13:58.221755Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
azure.platformlogs.properties.log.verb (elastic rule field)indelete1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Azure AKS Kubernetes Events Deleted source medium: Detects an identity deleting Kubernetes events on AKS (Azure Kubernetes Service), excluding known AKS control-plane and platform identities. Adversaries delete events (individually or in bulk via deletecollection) to remove evidence of pod creation, exec, or scheduling activity and impair incident response after operating in the cluster. Coverage includes workload service accounts (system:serviceaccount:*), so a compromised in-cluster token wiping events is not excluded.T1070↳ also matches delete-events: delete events
    Investigation guide

    Triage and analysis#

    Investigating Azure AKS Kubernetes Events Deleted#

    AKS kube-audit events are carried under the flattened azure.platformlogs.properties.log.* subtree and share the ARM operation event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read. Kubernetes events record pod scheduling, image pulls, and other cluster activity. Deleting them (individually with delete, or in bulk with deletecollection) outside of known AKS control-plane and platform identities is a defense-evasion step to erase evidence of prior actions.

    Possible investigation steps#

    • Identify the acting identity in azure.platformlogs.properties.log.user.username (and its groups in azure.platformlogs.properties.log.user.groups) and whether it should delete events. A username of masterclient (system:masters) is the AKS local cluster-admin certificate; workload service accounts (system:serviceaccount:<ns>:<sa>) deleting events are the higher-concern case.
    • Determine the scale from azure.platformlogs.properties.log.verb: deletecollection is a bulk wipe (e.g. kubectl delete events --all), while delete removes a single event. Review the target scope in azure.platformlogs.properties.log.objectRef.namespace / azure.platformlogs.properties.log.objectRef.name.
    • Inspect azure.platformlogs.properties.log.userAgent to distinguish interactive tooling (kubectl) from automation or custom clients, and pivot on azure.platformlogs.properties.log.sourceIPs for the activity the deletion may be concealing (pod creation, exec, RBAC changes).
    • Reconstruct the timeline from surviving kube-audit records, which persist independently of the deleted Kubernetes events.

    False positive analysis#

    • Event cleanup jobs or platform tooling may bulk-delete events; baseline the responsible identities and exclude verified automation. If a platform control-plane identity (for example an event TTL/garbage-collection component) surfaces, add that specific identity to the exclusion rather than re-broadening to all system:*, which would blind the rule to compromised workload service accounts.

    Response and remediation#

    • If unauthorized, revoke the acting identity's tokens and review the RBAC that permitted event deletion.
    • Use kube-audit history to reconstruct the concealed activity and scope the incident.
    • Collect kube-audit and identity artifacts per incident response procedures.

References #

any verb on events (synthetic aggregation)

#
Resource
events

Description

Synthetic aggregation for rules that filter the events resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
kubernetes.audit.stage (elastic rule field)eqresponsecomplete1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Kubernetes Unusual Decision by User Agent source low: This rule detects unusual request responses in Kubernetes audit logs through the use of the "new_terms" rule type. In production environments, default API requests are typically made by system components or trusted users, who are expected to have a consistent user agent and allowed response annotations. By monitoring for anomalies in the username and response annotations, this rule helps identify potential unauthorized access or misconfigurations in the Kubernetes environment.T1078