Query: rule covering Identifies the deletion of Azure Kubernetes Pods.
Matching passage: Sigma rule: Identifies the deletion of Azure Kubernetes Pods.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Pods Deleted id: b02f9591-12c3-4965-986a-88028629b2e1 status: test description: Identifies the deletion of Azure Kubernetes Pods. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://github.com/elastic/detection-rules/blob/065bf48a9987cd8bd826c098a30ce36e6868ee46/rules/integrations/azure/impact_kubernetes_pod_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/PODS/DELETE condition: selection falsepositives: - Pods may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Pods deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects suspicious PowerShell invocation with a parameter substring. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Parameter Substring id: 36210e0d-5b19-485d-a087-c096088885f0 status: test description: Detects suspicious PowerShell invocation with a parameter substring references: - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix) date: 2019-01-16 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -windowstyle h ' - ' -windowstyl h' - ' -windowsty h' - ' -windowst h' - ' -windows h' - ' -windo h' - ' -wind h' - ' -win h' - ' -wi h' - ' -win h ' - ' -win hi ' - ' -win hid ' - ' -win hidd ' - ' -win hidde ' - ' -NoPr ' - ' -NoPro ' - ' -NoProf ' - ' -NoProfi ' - ' -NoProfil ' - ' -nonin ' - ' -nonint ' - ' -noninte ' - ' -noninter ' - ' -nonintera ' - ' -noninterac ' - ' -noninteract ' - ' -noninteracti ' - ' -noninteractiv ' - ' -ec ' - ' -encodedComman ' - ' -encodedComma ' - ' -encodedComm ' - ' -encodedCom ' - ' -encodedCo ' - ' -encodedC ' - ' -encoded ' - ' -encode ' - ' -encod ' - ' -enco ' - ' -en ' - ' -executionpolic ' - ' -executionpoli ' - ' -executionpol ' - ' -executionpo ' - ' -executionp ' - ' -execution bypass' - ' -executio bypass' - ' -executi bypass' - ' -execut bypass' - ' -execu bypass' - ' -exec bypass' - ' -exe bypass' - ' -ex bypass' - ' -ep bypass' - ' /windowstyle h ' - ' /windowstyl h' - ' /windowsty h' - ' /windowst h' - ' /windows h' - ' /windo h' - ' /wind h' - ' /win h' - ' /wi h' - ' /win h ' - ' /win hi ' - ' /win hid ' - ' /win hidd ' - ' /win hidde ' - ' /NoPr ' - ' /NoPro ' - ' /NoProf ' - ' /NoProfi ' - ' /NoProfil ' - ' /nonin ' - ' /nonint ' - ' /noninte ' - ' /noninter ' - ' /nonintera ' - ' /noninterac ' - ' /noninteract ' - ' /noninteracti ' - ' /noninteractiv ' - ' /ec ' - ' /encodedComman ' - ' /encodedComma ' - ' /encodedComm ' - ' /encodedCom ' - ' /encodedCo ' - ' /encodedC ' - ' /encoded ' - ' /encode ' - ' /encod ' - ' /enco ' - ' /en ' - ' /executionpolic ' - ' /executionpoli ' - ' /executionpol ' - ' /executionpo ' - ' /executionp ' - ' /execution bypass' - ' /executio bypass' - ' /executi bypass' - ' /execut bypass' - ' /execu bypass' - ' /exec bypass' - ' /exe bypass' - ' /ex bypass' - ' /ep bypass' condition: selection falsepositives: - Unknown level: high