Kubernetes Audit: Admission Webhook Configuration Changes via API Actions

title: "Kubernetes Audit: Admission Webhook Configuration Changes via API Actions"
id: 6f056d47-c8dc-4426-a496-cf3301ef5fba
related:
  - id: 6ad91e31-53df-4826-bd27-0166171c8040
    type: similar
  - id: eed82177-38f5-4299-8a76-098d50d225ab
    type: derived
status: test
description: This rule flags Kubernetes API audit events where a client performs create, update, patch, replace, or delete operations on mutating or validating webhook configurations (admissionregistration.k8s.io). Attackers can abuse admission webhooks to persistently intercept or influence requests, enabling credential access and unauthorized actions. It relies on Kubernetes audit log telemetry capturing the API group, resource type, and HTTP verb associated with the configuration change.
references:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://security.padok.fr/en/blog/kubernetes-webhook-attackers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078
  - attack.credential-access
  - attack.t1552
  - attack.t1552.007
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.apiGroup: admissionregistration.k8s.io
    objectRef.resource:
      - mutatingwebhookconfigurations
      - validatingwebhookconfigurations
    verb:
      - create
      - delete
      - patch
      - replace
      - update
  condition: selection
falsepositives:
  - Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
  - Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1