Kubernetes API Audit: Admission Webhook Configuration Modified

title: "Kubernetes API Audit: Admission Webhook Configuration Modified"
id: 6f056d47-c8dc-4426-a496-cf3301ef5fba
related:
  - id: 6ad91e31-53df-4826-bd27-0166171c8040
    type: similar
  - id: eed82177-38f5-4299-8a76-098d50d225ab
    type: derived
status: test
description: This rule flags Kubernetes API audit events where mutatingwebhookconfigurations or validatingwebhookconfigurations in the admissionregistration.k8s.io API group are modified via create, patch, replace, or update. It also includes delete operations against these objects. Changes to admission webhooks can give an attacker a mechanism for persistence or to influence how requests are processed, potentially enabling credential access or stealthy execution. The detection relies on Kubernetes audit telemetry that records objectRef API group, resource, and verb for these admission webhook configuration changes.
references:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://security.padok.fr/en/blog/kubernetes-webhook-attackers
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
  - attack.privilege-escalation
  - attack.initial-access
  - attack.persistence
  - attack.stealth
  - attack.t1078
  - attack.credential-access
  - attack.t1552
  - attack.t1552.007
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.apiGroup: admissionregistration.k8s.io
    objectRef.resource:
      - mutatingwebhookconfigurations
      - validatingwebhookconfigurations
    verb:
      - create
      - delete
      - patch
      - replace
      - update
  condition: selection
falsepositives:
  - Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
  - Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1