Azure AKS Kubernetes Events Deleted

[metadata]
creation_date = "2026/07/09"
integration = ["azure"]
maturity = "production"
updated_date = "2026/07/09"

[rule]
author = ["Elastic"]
description = """
Detects an identity deleting Kubernetes events on AKS (Azure Kubernetes Service), excluding known AKS control-plane and
platform identities. Adversaries delete events (individually or in bulk via deletecollection) to remove evidence of pod
creation, exec, or scheduling activity and impair incident response after operating in the cluster. Coverage includes
workload service accounts (system:serviceaccount:*), so a compromised in-cluster token wiping events is not excluded.
"""
false_positives = [
    """
    Event cleanup jobs or platform tooling may bulk-delete events. Baseline the responsible identities and exclude
    verified automation after review.
    """,
]
from = "now-9m"
index = ["logs-azure.platformlogs-*"]
language = "kuery"
license = "Elastic License v2"
name = "Azure AKS Kubernetes Events Deleted"
note = """## Triage and analysis

### Investigating Azure AKS Kubernetes Events Deleted

AKS kube-audit events are carried under the flattened `azure.platformlogs.properties.log.*` subtree and share the ARM
operation `event.action: Microsoft.ContainerService/managedClusters/diagnosticLogs/Read`. Kubernetes events record pod
scheduling, image pulls, and other cluster activity. Deleting them (individually with `delete`, or in bulk with
`deletecollection`) outside of known AKS control-plane and platform identities is a defense-evasion step to erase
evidence of prior actions.

### Possible investigation steps

- Identify the acting identity in `azure.platformlogs.properties.log.user.username` (and its groups in
  `azure.platformlogs.properties.log.user.groups`) and whether it should delete events. A username of `masterclient`
  (`system:masters`) is the AKS local cluster-admin certificate; workload service accounts
  (`system:serviceaccount:<ns>:<sa>`) deleting events are the higher-concern case.
- Determine the scale from `azure.platformlogs.properties.log.verb`: `deletecollection` is a bulk wipe (e.g.
  `kubectl delete events --all`), while `delete` removes a single event. Review the target scope in
  `azure.platformlogs.properties.log.objectRef.namespace` / `azure.platformlogs.properties.log.objectRef.name`.
- Inspect `azure.platformlogs.properties.log.userAgent` to distinguish interactive tooling (`kubectl`) from automation
  or custom clients, and pivot on `azure.platformlogs.properties.log.sourceIPs` for the activity the deletion may be
  concealing (pod creation, exec, RBAC changes).
- Reconstruct the timeline from surviving kube-audit records, which persist independently of the deleted Kubernetes
  events.

### False positive analysis

- Event cleanup jobs or platform tooling may bulk-delete events; baseline the responsible identities and exclude
  verified automation. If a platform control-plane identity (for example an event TTL/garbage-collection component)
  surfaces, add that specific identity to the exclusion rather than re-broadening to all `system:*`, which would blind
  the rule to compromised workload service accounts.

### Response and remediation

- If unauthorized, revoke the acting identity's tokens and review the RBAC that permitted event deletion.
- Use kube-audit history to reconstruct the concealed activity and scope the incident.
- Collect kube-audit and identity artifacts per incident response procedures.
"""
references = [
    "https://kubernetes.io/docs/reference/kubernetes-api/cluster-resources/event-v1/",
    "https://microsoft.github.io/Threat-Matrix-for-Kubernetes/",
    "https://learn.microsoft.com/en-us/azure/aks/monitor-aks",
    "https://kubenomicon.com/Defense_evasion/Delete_events.html"
]
risk_score = 47
rule_id = "9bc14983-fabc-4a3e-896d-3632a902f17c"
setup = """
The Azure Fleet integration collecting AKS diagnostic logs forwarded through Event Hub into the `azure.platformlogs`
data stream is required for this rule. Enable either the `kube-audit` or the `kube-audit-admin` log category (Microsoft
recommends `kube-audit-admin` alone to reduce volume, as it only drops read-only get/list events). Event deletions are
mutating operations recorded in both categories with the same `auditID`, so clusters that enable both categories may
generate two alerts per deletion.
"""
severity = "medium"
tags = [
    "Domain: Cloud",
    "Domain: Kubernetes",
    "Data Source: Azure",
    "Data Source: Azure Platform Logs",
    "Data Source: Kubernetes",
    "Use Case: Threat Detection",
    "Tactic: Defense Evasion",
    "Resources: Investigation Guide",
]
timestamp_override = "event.ingested"
type = "query"

query = '''
data_stream.dataset:azure.platformlogs and
  event.action:"Microsoft.ContainerService/managedClusters/diagnosticLogs/Read" and
  azure.platformlogs.category:("kube-audit" or "kube-audit-admin") and
  azure.platformlogs.properties.log.stage:"ResponseComplete" and
  azure.platformlogs.properties.log.objectRef.resource:"events" and
  azure.platformlogs.properties.log.verb:("delete" or "deletecollection") and
  not azure.platformlogs.properties.log.user.username:(
    system\:node\:* or "aksService" or "hcpService" or "readinessChecker" or
    system\:serviceaccount\:kube-system\:*
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"


[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "event.action",
    "azure.platformlogs.category",
    "azure.platformlogs.properties.log.verb",
    "azure.platformlogs.properties.log.user.username",
    "azure.platformlogs.properties.log.user.groups",
    "azure.platformlogs.properties.log.userAgent",
    "azure.platformlogs.properties.log.sourceIPs",
    "azure.platformlogs.properties.log.objectRef.namespace",
    "azure.platformlogs.properties.log.objectRef.name",
    "azure.platformlogs.properties.log.requestURI",
    "azure.platformlogs.properties.log.responseStatus.code",
]