security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update azure_kubernetes_events_deleted.yml

Browse Source
This commit is contained in:
Austin Songer
2021-07-24 10:44:06 -05:00
committed by GitHub
parent e123635c42
commit 9a9f0cf594
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/cloud/azure_kubernetes_events_deleted.yml
+3 -3
View File
@@ -10,14 +10,14 @@ references:
logsource:
service: azure.activitylogs
detection:
selection_operationname:
selection_operation_name:
- properties.message: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE
condition: all of them
condition: selection_operation_name
level: medium
tags:
- attack.defense_evasion
- attack.t1562
- attack.t1562.001
falsepositives:
- Events deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
- Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule.