deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Remote Schedule Task Recon via ITaskSchedulerService
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to read information about scheduled tasks

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "86d35949-83c9-4044-b424-db363231fd0c"
  },
  "filter": {
    "OpNum": [
      1,
      3,
      4,
      10,
      11,
      12,
      13,
      14,
      15
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Event Log Recon
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to get event log information via EVEN or EVEN6

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": [
      "82273fdc-e32a-18c3-3f78-827929dc23ea",
      "f6beaff7-1e19-4fbb-9f8f-b89e2018337c"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Printing Abuse for Lateral Movement
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to possibly abuse remote printing service via MS-RPRN / MS-PAR

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": [
      "12[PII_REDACTED]-abcd-ef00[PII_REDACTED]ab",
      "76f03f96-cdfd-44fc-a22c-64950a001209",
      "0b6edbfa-4a24-4fc6-8a23-942b1eca65d1",
      "ae33069b-a2a8-46ee-a235-ddfd339be281"
    ]
  },
  "condition": "selection"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RPRN-PAR.md
  - https://github.com/zeronetworks/rpcfirewall
Sigma Detection Rule: SharpHound Recon Sessions
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1033
Log source: rpc_firewall/application

Description:
Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188",
    "OpNum": 12
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Recon Activity via SASec
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to read information about scheduled tasks via SASec

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "378e52b0-c0a9-11cf-822d-00aa0051e40f"
  },
  "filter": {
    "OpNum": [
      0,
      1
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote Server Service Abuse for Lateral Movement
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1569.002
Log source: rpc_firewall/application

Description:
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": "367abb81-9844-35f1-ad32-98f038001003"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
  - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SCMR.md
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Remote DCOM/WMI Lateral Movement
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sagie Dulce, Dekel Paz
Date: 2022-01-01
ATT&CK techniques: T1021.003, T1047
Log source: rpc_firewall/application

Description:
Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Detection logic:
{
  "selection": {
    "EventLog": "RPCFW",
    "EventID": 3,
    "InterfaceUuid": [
      "4d9f4ab8-7d1c-11cf-861e-0020af6e7c57",
      "99fcfec4-5260-101b-bbcb-00aa0021347a",
      "000001a0-0000-0000-c[PII_REDACTED]00046",
      "[PII_REDACTED]-c[PII_REDACTED]00046",
      "[PII_REDACTED]-c[PII_REDACTED]00046",
      "[PII_REDACTED]-c[PII_REDACTED]00046"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
  - https://github.com/zeronetworks/rpcfirewall
  - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
Sigma Detection Rule: Github New Secret Created
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-01-20
ATT&CK techniques: T1078.004
Log source: github/

Description:
Detects when a user creates action secret for the organization, environment, codespaces or repository.

Detection logic:
{
  "selection": {
    "action": [
      "codespaces.create_an_org_secret",
      "environment.create_actions_secret",
      "org.create_actions_secret",
      "repo.create_actions_secret"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
Sigma Detection Rule: Github Self Hosted Runner Changes Detected
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-01-27
ATT&CK techniques: T1526, T1213.003, T1078.004
Log source: github/

Description:
A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
it should be validated from GitHub UI because the log entry may not provide full context.


Detection logic:
{
  "selection": {
    "action": [
      "org.remove_self_hosted_runner",
      "org.runner_group_created",
      "org.runner_group_removed",
      "org.runner_group_runner_removed",
      "org.runner_group_runners_added",
      "org.runner_group_runners_updated",
      "org.runner_group_updated",
      "repo.register_self_hosted_runner",
      "repo.remove_self_hosted_runner"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation
Sigma Detection Rule: Outdated Dependency Or Vulnerability Alert Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-01-27
ATT&CK techniques: T1195.001
Log source: github/

Description:
Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.


Detection logic:
{
  "selection": {
    "action": [
      "dependabot_alerts_new_repos.disable",
      "dependabot_alerts.disable",
      "dependabot_security_updates_new_repos.disable",
      "dependabot_security_updates.disable",
      "repository_vulnerability_alerts.disable"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization
Sigma Detection Rule: GitHub Repository Pages Site Changed to Public
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Ivan Saakov
Date: 2025-10-18
ATT&CK techniques: T1567.001
Log source: github/

Description:
Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.


Detection logic:
{
  "selection": {
    "action": "repo.pages_public"
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site
  - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
  - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
Sigma Detection Rule: GitHub Repository Archive Status Changed
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Ivan Saakov
Date: 2025-10-18
Log source: github/

Description:
Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.


Detection logic:
{
  "selection": {
    "action": [
      "repo.archived",
      "repo.unarchived"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
  - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
  - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
Sigma Detection Rule: New Github Organization Member Added
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-01-29
ATT&CK techniques: T1136.003
Log source: github/

Description:
Detects when a new member is added or invited to a github organization.

Detection logic:
{
  "selection": {
    "action": [
      "org.add_member",
      "org.invite_member"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
Sigma Detection Rule: Github High Risk Configuration Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-01-29
ATT&CK techniques: T1556
Log source: github/

Description:
Detects when a user disables a critical security feature for an organization.

Detection logic:
{
  "selection": {
    "action": [
      "business_advanced_security.disabled_for_new_repos",
      "business_advanced_security.disabled_for_new_user_namespace_repos",
      "business_advanced_security.disabled",
      "business_advanced_security.user_namespace_repos_disabled",
      "org.advanced_security_disabled_for_new_repos",
      "org.advanced_security_disabled_on_all_repos",
      "org.advanced_security_policy_selected_member_disabled",
      "org.disable_oauth_app_restrictions",
      "org.disable_two_factor_requirement",
      "repo.advanced_security_disabled"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions
  - https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise
Sigma Detection Rule: Github Secret Scanning Feature Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-03-07
ATT&CK techniques: T1685
Log source: github/

Description:
Detects if the secret scanning feature is disabled for an enterprise or repository.

Detection logic:
{
  "selection": {
    "action": [
      "business_secret_scanning.disable",
      "business_secret_scanning.disabled_for_new_repos",
      "repository_secret_scanning.disable",
      "secret_scanning_new_repos.disable",
      "secret_scanning.disable"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning
Sigma Detection Rule: Github Repository/Organization Transferred
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Romain Gaillard (@romain-gaillard)
Date: 2024-07-29
ATT&CK techniques: T1020, T1537
Log source: github/

Description:
Detects when a repository or an organization is being transferred to another location.

Detection logic:
{
  "selection": {
    "action": [
      "migration.create",
      "org.transfer_outgoing",
      "org.transfer",
      "repo.transfer_outgoing"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
  - https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership
  - https://docs.github.com/en/migrations
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
Sigma Detection Rule: Github Fork Private Repositories Setting Enabled/Cleared
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Romain Gaillard (@romain-gaillard)
Date: 2024-07-29
ATT&CK techniques: T1020, T1537
Log source: github/

Description:
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).


Detection logic:
{
  "selection": {
    "action": [
      "private_repository_forking.clear",
      "private_repository_forking.enable"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#private_repository_forking
Sigma Detection Rule: Github Outside Collaborator Detected
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-01-20
ATT&CK techniques: T1098.001, T1098.003, T1213.003
Log source: github/

Description:
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.


Detection logic:
{
  "selection": {
    "action": [
      "org.remove_outside_collaborator",
      "project.update_user_permission"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization
Sigma Detection Rule: Github Push Protection Bypass Detected
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-03-07
ATT&CK techniques: T1685
Log source: github/

Description:
Detects when a user bypasses the push protection on a secret detected by secret scanning.

Detection logic:
{
  "selection": {
    "action|contains": "secret_scanning_push_protection.bypass"
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
  - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
Sigma Detection Rule: Github SSH Certificate Configuration Changed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Romain Gaillard (@romain-gaillard)
Date: 2024-07-29
ATT&CK techniques: T1078.004
Log source: github/

Description:
Detects when changes are made to the SSH certificate configuration of the organization.

Detection logic:
{
  "selection": {
    "action": [
      "ssh_certificate_authority.create",
      "ssh_certificate_requirement.disable"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities
  - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority
Sigma Detection Rule: Github Push Protection Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-03-07
ATT&CK techniques: T1685
Log source: github/

Description:
Detects if the push protection feature is disabled for an organization, enterprise, repositories or custom pattern rules.

Detection logic:
{
  "selection": {
    "action": [
      "business_secret_scanning_custom_pattern_push_protection.disabled",
      "business_secret_scanning_push_protection.disable",
      "business_secret_scanning_push_protection.disabled_for_new_repos",
      "org.secret_scanning_custom_pattern_push_protection_disabled",
      "org.secret_scanning_push_protection_disable",
      "org.secret_scanning_push_protection_new_repos_disable",
      "repository_secret_scanning_custom_pattern_push_protection.disabled"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
  - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
Sigma Detection Rule: Github Delete Action Invoked
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-01-19
ATT&CK techniques: T1213.003
Log source: github/

Description:
Detects delete action in the Github audit logs for codespaces, environment, project and repo.

Detection logic:
{
  "selection": {
    "action": [
      "codespaces.destroy",
      "environment.delete",
      "project.delete",
      "repo.destroy"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#audit-log-actions
  - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces
Sigma Detection Rule: Kubernetes Unauthorized or Unauthenticated Access
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: kelnage
Date: 2024-04-12
Log source: kubernetes/

Description:
Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used.
This may indicate an attacker attempting to leverage credentials they have obtained.


Detection logic:
{
  "selection": {
    "responseStatus.code": [
      401,
      403
    ]
  },
  "condition": "selection"
}

References:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues
Sigma Detection Rule: RBAC Permission Enumeration Attempt
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1069.003, T1087.004
Log source: kubernetes/application

Description:
Detects identities attempting to enumerate their Kubernetes RBAC permissions.
In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.
In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command.
This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.


Detection logic:
{
  "selection": {
    "verb": "create",
    "apiGroup": "authorization.k8s.io",
    "objectRef.resource": "selfsubjectrulesreviews"
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html
Sigma Detection Rule: Container With A hostPath Mount Created
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1611
Log source: kubernetes/application

Description:
Detects creation of a container with a hostPath mount.
A hostPath volume mounts a directory or a file from the node to the container.
Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node.


Detection logic:
{
  "selection": {
    "verb": "create",
    "objectRef.resource": "pods",
    "hostPath": "*"
  },
  "condition": "selection"
}

References:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/
  - https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
Sigma Detection Rule: Deployment Deleted From Kubernetes Cluster
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1498
Log source: kubernetes/application

Description:
Detects the removal of a deployment from a Kubernetes cluster.
This could indicate disruptive activity aiming to impact business operations.


Detection logic:
{
  "selection": {
    "verb": "delete",
    "objectRef.resource": "deployments"
  },
  "condition": "selection"
}

References:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/