Detects modifications to CoreDNS or kube-dns ConfigMaps in the kube-system namespace of AKS clusters. An attacker who edits CoreDNS/kube-dns or creates/edits a user-managed coredns-custom ConfigMap can inject forward or rewrite rules to redirect DNS lookups to attacker-controlled endpoints. This enables cluster-wide interception of credentials and traffic (Man-in-the-Middle) and can facilitate credential theft. The rule uses Azure Platform Logs (azure.platformlogs) with event.action Microsoft.ContainerService/managedClusters/diagnosticLogs/Read; it fires on create/update/patch/delete of ConfigMaps named coredns, kube-dns, or coredns-custom in the kube-system namespace. To reduce noise, known AKS platform identities (e.g., aksService) and other system identities are excluded; but workload service accounts (system:serviceaccount:<ns>:<sa>) remain a signal. Investigation focuses on the log fields azure.platformlogs.properties.log.user.username and groups, azure.platformlogs.properties.log.objectRef.name and namespace, the verb, and the content of the changed ConfigMap (azure.platformlogs.properties.log.requestObject.data). The activity maps to MITRE ATT&CK T1557 Adversary-in-the-Middle under Credential Access (TA0006). The rule benefits from the Azure Fleet integration and requires enabling kube-audit or kube-audit-admin so mutating operations are captured. False positives include legitimate CoreDNS customization via approved automation or GitOps; in such cases validate the change window and exclude verified service accounts. Remediation includes restoring the ConfigMap from a known-good source, revoking the acting identity’s tokens, reviewing RBAC, and hunting for credential capture during the window.