GCP Kubernetes audit events: Admission webhook configuration creates/updates

title: "GCP Kubernetes audit events: Admission webhook configuration creates/updates"
id: f268b712-20d4-46cc-9b38-48d8cd4447e4
status: test
description: This rule identifies Kubernetes admission webhook configuration changes in Google Cloud by matching audit method names under admissionregistration.k8s.io for mutating and validating webhooks. Attackers can leverage these webhooks to intercept or modify API requests, enabling persistence, stealthy execution, and potential credential or secret capture. Telemetry is based on GCP audit log method_name values corresponding to create, patch, or replace operations on mutatingwebhookconfigurations or validatingwebhookconfigurations.
references:
  - https://cloud.google.com/kubernetes-engine/docs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-25
modified: 2022-12-18
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078
  - attack.credential-access
  - attack.t1552
  - attack.t1552.007
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name|startswith: admissionregistration.k8s.io.v
    gcp.audit.method_name|contains:
      - .mutatingwebhookconfigurations.
      - .validatingwebhookconfigurations.
    gcp.audit.method_name|endswith:
      - create
      - patch
      - replace
  condition: selection
falsepositives:
  - Google Cloud Kubernetes Admission Controller may be done by a system administrator.
  - If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 6ad91e31-53df-4826-bd27-0166171c8040
    type: derived