Suspicious Kubernetes Admission Controller Change (via audit)

title: Suspicious Kubernetes Admission Controller Change (via audit)
id: c7c90ab5-81e4-5dbf-a894-01838a2697fd
status: stable
description: This rule detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
references:
    - https://attack.mitre.org/techniques/T1552/007/
    - https://attack.mitre.org/techniques/T1552/
    - https://attack.mitre.org/techniques/T1078/
    - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
    - https://security.padok.fr/en/blog/kubernetes-webhook-attackers
author: Huntrule Team
date: 2026-01-18
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.persistence
    - attack.stealth
    - attack.t1078
    - attack.credential-access
    - attack.t1552
    - attack.t1552.007
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        objectRef.apiGroup: 'admissionregistration.k8s.io'
        objectRef.resource:
            - 'mutatingwebhookconfigurations'
            - 'validatingwebhookconfigurations'
        verb:
            - 'create'
            - 'delete'
            - 'patch'
            - 'replace'
            - 'update'
    condition: selection
falsepositives:
    - Unknown
level: medium