Product
Azure Kubernetes Service: Multi-resource discovery detection
1 TTPThis detection identifies potential reconnaissance activity in Azure Kubernetes Service (AKS) by flagging identities that enumerate three or more distinct Kubernetes API resource types within a short timeframe.
Azure Kubernetes Events Deleted
2 rules 1 TTPAdversaries may delete events in Azure Kubernetes to evade detection, which this rule detects via the MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE operation.
Malicious Azure Kubernetes Admission Controller Configuration
2 rules 4 TTPsAn adversary can exploit Kubernetes Admission Controllers in Azure to achieve persistence, privilege escalation, or credential access by manipulating webhook configurations.
Azure Kubernetes Services (AKS) Kubernetes Events Deleted
2 rules 2 TTPsAdversaries may delete Kubernetes events in Azure Kubernetes Services (AKS) to evade detection by removing logs of state changes, container creations, image pulls, and pod scheduling.