Attack Chain

1. The attacker gains initial access to the Azure environment, potentially through compromised credentials or exploiting a vulnerability.
2. The attacker authenticates to the Azure Kubernetes Service (AKS) cluster with sufficient privileges.
3. The attacker enumerates existing Kubernetes event logs to identify those they wish to remove.
4. The attacker executes a command to delete specific Kubernetes events using kubectl or the Azure CLI. The API call used for the deletion is MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE.
5. The Azure Activity Logs record the event deletion, which is the source of the detection.
6. The attacker repeats steps 3-4 to remove additional event logs, further obscuring their activities.
7. The attacker continues with their primary objective, such as deploying malicious containers, exfiltrating data, or establishing persistent access.

Impact

Successful deletion of Kubernetes events can significantly hinder incident response efforts. Without access to event logs, defenders may struggle to identify the scope and timeline of an attack, potentially leading to incomplete remediation and prolonged exposure. The impact includes increased dwell time for attackers within the compromised environment, as well as a greater likelihood of successful data breaches or system disruptions.

Recommendation

• Deploy the provided Sigma rule to your SIEM to detect event deletion activity within AKS environments.
• Investigate any detected instances of the MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE operation in Azure Activity Logs, as indicated in the rule definition.
• Implement robust RBAC policies within AKS to minimize the number of users and service accounts with permissions to delete Kubernetes events.