Deployment Deleted From Kubernetes Cluster

Title: Deployment Deleted From Kubernetes Cluster
Status: test
Description:Detects the removal of a deployment from a Kubernetes cluster. This could indicate disruptive activity aiming to impact business operations.
References:
  -https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
modified:None
Tags:

• -'attack.t1498'
• -'attack.impact'

Logsource:

• category: application
• product: kubernetes
• service: audit

Detection:
  selection:
    verb: 'delete'
    objectRef.resource: 'deployments'
  condition:selection
Falsepositives:
  -Unknown
Level: low