Detectionlowtest

Deployment Deleted From Kubernetes Cluster

Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Leo TsaousisCreated Tue Mar 2640967487-139b-4811-81d9-c9767a92aa5aapplication

Log Source

Kubernetesapplicationaudit

ProductKubernetes← raw: kubernetes

Categoryapplication← raw: application

Serviceaudit← raw: audit

Detection Logic

detection:
    selection:
        verb: 'delete'
        objectRef.resource: 'deployments'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

40967487-139b-4811-81d9-c9767a92aa5a

Status

test

Level

low

Type

Detection

Created

Tue Mar 26

Author

Path

rules/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml

Raw Tags

attack.t1498attack.impact