GCP Kubernetes Admission Webhook Configuration Changes via Audit Logs

title: GCP Kubernetes Admission Webhook Configuration Changes via Audit Logs
id: f268b712-20d4-46cc-9b38-48d8cd4447e4
status: test
description: This rule identifies execution events where Kubernetes admission webhook configurations are created, patched, or replaced in Google Cloud by matching GCP audit method names under admissionregistration.k8s.io.v* for both mutating and validating webhook configuration updates. Admission webhooks can intercept and modify API server requests, making them a key mechanism for persistence and potential credential or data exposure if abused by an attacker. The detection relies on GCP Kubernetes-related audit telemetry, specifically the method_name patterns indicating configuration changes for mutatingwebhookconfigurations and validatingwebhookconfigurations.
references:
  - https://cloud.google.com/kubernetes-engine/docs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-25
modified: 2022-12-18
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078
  - attack.credential-access
  - attack.t1552
  - attack.t1552.007
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name|startswith: admissionregistration.k8s.io.v
    gcp.audit.method_name|contains:
      - .mutatingwebhookconfigurations.
      - .validatingwebhookconfigurations.
    gcp.audit.method_name|endswith:
      - create
      - patch
      - replace
  condition: selection
falsepositives:
  - Google Cloud Kubernetes Admission Controller may be done by a system administrator.
  - If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 6ad91e31-53df-4826-bd27-0166171c8040
    type: derived