Skip to content

Delete EKS cluster

Platform Author Last Update
aws Anela Tiro 2023-07-01

An adversary may attempt to delete EKS cluster

MITRE IDs

Required Permissions

  • eks:DeleteCluster

Required Parameters

Name Type Description Example Value
name str Cluster name which will be deleted cluster_name

Attacker Action

aws eks delete-cluster --name cluster_name

Detection Case

ELK query

When logs are ingested into ELK, the following Lucene query can be used to identify relevant events.

eventName:DeleteCluster AND eventSource:*.eks.amazonaws.com  

Sigma Definition

---
title: Delete EKS cluster
id: testing
status: experimental
author: Anela Tiro
date: 2023-07-01
description: An adversary may attempt to delete EKS cluster
logsource:
  service: cloudtrail
detection:
  selection_source:
    - eventSource: "*.eks.amazonaws.com"
  events:
    - eventName: "DeleteCluster"
  condition: selection_source AND events
level: low
tags:
  - attack.None