Deployment Deleted From Kubernetes Cluster

Rule Info

Name
Deployment Deleted From Kubernetes Cluster
Author
Leo Tsaousis (@laripping)
Description
Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.
Reference
https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/
Date
2024-03-26 00:00:00
Modified
None
Id
40967487-139b-4811-81d9-c9767a92aa5a
Tags
attack.t1498 DEMO
Type
Community Rule
Link to Public Repo
https://github.com/SigmaHQ/sigma/search?q=40967487-139b-4811-81d9-c9767a92aa5a

Rule History

Author
Title
Date
Commit
Leo Tsaousis
Merge PR #4694 from @LAripping - Add native Kubernetes detections
2024-03-26
0d63f52ff
THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022