Azure Kubernetes Service Account Modified or Deleted

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•27

Identifies when a service account in Azure Kubernetes Service is modified or deleted. This could indicate an adversary attempting to disrupt services, remove access, or manipulate accounts for persistence or privilege escalation within the Kubernetes cluster.