Kubernetes API Audit: Admission Webhook Configuration Modified

Kubernetes audit alerts on API modifications to mutating/validating webhook configurations that can enable persistence or credential access.

FreeReviewedSigma · Medium · v5

Product: kubernetes
Service: audit
Author: kelnage (SigmaHQ), DRL 1.1
Published: 2024-07-11
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Initial Access → Cred Access

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
Execution
Persistence
- T1078Valid Accounts
Priv Esc
- T1078Valid Accounts
Defense Evasion
- T1078Valid Accounts
Cred Access
- T1552Unsecured Credentials
- T1552.007Container API
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Kubernetes API audit events where mutatingwebhookconfigurations or validatingwebhookconfigurations in the admissionregistration.k8s.io API group are modified via create, patch, replace, or update. It also includes delete operations against these objects. Changes to admission webhooks can give an attacker a mechanism for persistence or to influence how requests are processed, potentially enabling credential access or stealthy execution. The detection relies on Kubernetes audit telemetry that records objectRef API group, resource, and verb for these admission webhook configuration changes.

Reporting behind it

Related detections9 linkedT1078 — drag to rearrange

GCP Kubernetes audit events: Admission webhook configuration creates/updates

Azure Activity Logs: Kubernetes AdmissionRegistration webhook configuration writes

Malicious SD-WAN Compromise Credential Theft via loot_run.sh

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Possible SSRF via VMware Workspace One Access instanceHealth CVE-2021-22056

Suspicious Brutforce with Denied Access Due to Account Restrictions Policies (via security)

Suspicious Success Login Attempt on a Windows OpenSSH Server (via security)

Suspicious SQL Server - Connection Attempt Using a Disabled Account (via application)

Suspicious Lateral Movement Detection - Based on "special Groups" Feature (via security)

Kubernetes API Audit: Admission Webhook Configuration Modified

Pivot detection · T1078 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

kubernetes-audit-admission-webhook-configuration-changes-via-api-actions-eed82177

title: "Kubernetes API Audit: Admission Webhook Configuration Modified"
id: 6f056d47-c8dc-4426-a496-cf3301ef5fba
related:
  - id: 6ad91e31-53df-4826-bd27-0166171c8040
    type: similar
  - id: eed82177-38f5-4299-8a76-098d50d225ab
    type: derived
status: test
description: This rule flags Kubernetes API audit events where mutatingwebhookconfigurations or validatingwebhookconfigurations in the admissionregistration.k8s.io API group are modified via create, patch, replace, or update. It also includes delete operations against these objects. Changes to admission webhooks can give an attacker a mechanism for persistence or to influence how requests are processed, potentially enabling credential access or stealthy execution. The detection relies on Kubernetes audit telemetry that records objectRef API group, resource, and verb for these admission webhook configuration changes.
references:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://security.padok.fr/en/blog/kubernetes-webhook-attackers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078
  - attack.credential-access
  - attack.t1552
  - attack.t1552.007
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.apiGroup: admissionregistration.k8s.io
    objectRef.resource:
      - mutatingwebhookconfigurations
      - validatingwebhookconfigurations
    verb:
      - create
      - delete
      - patch
      - replace
      - update
  condition: selection
falsepositives:
  - Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
  - Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL