Azure Activity Logs: Kubernetes Admission Webhook Configuration Write

title: "Azure Activity Logs: Kubernetes Admission Webhook Configuration Write"
id: f29d530b-5b7e-4599-b7e8-b9577fda1b62
status: test
description: This rule identifies when a Kubernetes admission webhook configuration is written in Azure, covering both mutating and validating admission webhook registration resources. Changing admission webhook configuration is significant because it can enable request interception or modification at the Kubernetes API layer, which attackers can misuse for persistence, stealth, or credential and secret access. The detection relies on Azure activity log records whose operationName indicates admission registration write actions for mutating or validating webhook configurations.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-25
modified: 2022-12-18
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078
  - attack.credential-access
  - attack.t1552
  - attack.t1552.007
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName|startswith:
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO
      - MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO
    operationName|endswith:
      - /MUTATINGWEBHOOKCONFIGURATIONS/WRITE
      - /VALIDATINGWEBHOOKCONFIGURATIONS/WRITE
  condition: selection
falsepositives:
  - Azure Kubernetes Admissions Controller may be done by a system administrator.
  - If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: a61a3c56-4ce2-4351-a079-88ae4cbd2b58
    type: derived