Detects deletion of Kubernetes events in Azure Kubernetes Service (AKS) clusters by monitoring Azure platform logs (azure.platformlogs) for kube-audit activity that reads diagnostic logs. Specifically, it surfaces Read operations for Microsoft.ContainerService/managedClusters/diagnosticLogs and verbs delete or deletecollection (single or bulk deletion of events). The rule excludes known AKS control-plane and platform identities (e.g., system:*, kube-system) to focus on potentially compromised workload identities (including system:serviceaccount:*). Deleting kube-audit events is a defense-evasion technique intended to erase evidence of pod creation, exec, scheduling, RBAC changes, or other cluster activity, thereby hindering incident response. The detection covers workload service accounts (system:serviceaccount:<ns>:<sa>) as a high-risk scenario. The detection query narrows results to the azure.platformlogs dataset with the Read action, category kube-audit or kube-audit-admin, stage ResponseComplete, and objectRef.resource events, filtering out trusted identities. It recommends triaging by identifying the acting identity (azure.platformlogs.properties.log.user.username and groups), distinguishing interactive tools from automated clients, evaluating the scope (delete vs deletecollection; target namespace/name), and reconstructing timelines from surviving kube-audit records. False positives include legitimate event cleanup jobs or platform tooling performing bulk deletions; these should be excluded once automation is verified. Recommended responses include revoking tokens for unauthorized identities, reviewing and tightening RBAC, and coordinating with incident response to collect kube-audit and identity artifacts. This rule aligns with defense-evasion techniques (MITRE T1070) and is intended to detect attempts to erase operational history in AKS environments.