An AWS EKS cluster was created or deleted

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	AWS Audit Log
Detection Modules	Cloud
ATT&CK Tactic	Initial Access (TA0001), Impact (TA0040)
ATT&CK Technique	Data Destruction (T1485), Valid Accounts (T1078)
Severity	Informational

Description

An AWS EKS cluster has been created or deleted.

Attacker's Goals

Gain access to the cluster and its resources. Gain access to sensitive data stored in the cluster.

Investigative actions

Check whether the identity is authorized to perform changes to AWS EKS clusters.