{"id":"6ad91e31-53df-4826-bd27-0166171c8040","title":"Google Cloud Kubernetes Admission Controller","description":"Identifies when an admission controller is executed in GCP Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-11-25","modified":"2022-12-18","tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.credential-access","attack.t1552","attack.t1552.007"],"technique_ids":["T1078","T1552","T1552.007"],"logsource":{"product":"gcp","service":"gcp.audit"},"falsepositives":["Google Cloud Kubernetes Admission Controller may be done by a system administrator.","If known behavior is causing false positives, it can be exempted from the rule."],"references":["https://cloud.google.com/kubernetes-engine/docs"],"source_path":"rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml","source_sha256":"6d513c7caa9d98ec276ced79e0a7eac0d964964c150728c5946de48b58cc31ad","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Google Cloud Kubernetes Admission Controller\nid: 6ad91e31-53df-4826-bd27-0166171c8040\nstatus: test\ndescription: |\n  Identifies when an admission controller is executed in GCP Kubernetes.\n  A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\n  The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\n  An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\n  For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\n  An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\nreferences:\n    - https://cloud.google.com/kubernetes-engine/docs\nauthor: Austin Songer @austinsonger\ndate: 2021-11-25\nmodified: 2022-12-18\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.persistence\n    - attack.stealth\n    - attack.t1078\n    - attack.credential-access\n    - attack.t1552\n    - attack.t1552.007\nlogsource:\n    product: gcp\n    service: gcp.audit\ndetection:\n    selection:\n        gcp.audit.method_name|startswith: 'admissionregistration.k8s.io.v'\n        gcp.audit.method_name|contains:\n            - '.mutatingwebhookconfigurations.'\n            - '.validatingwebhookconfigurations.'\n        gcp.audit.method_name|endswith:\n            - 'create'\n            - 'patch'\n            - 'replace'\n    condition: selection\nfalsepositives:\n    - Google Cloud Kubernetes Admission Controller may be done by a system administrator.\n    - If known behavior is causing false positives, it can be exempted from the rule.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1552","id":"T1552","name":"Unsecured Credentials","page":"techniques/enterprise/T1552/"},{"key":"enterprise/T1552.007","id":"T1552.007","name":"Container API","page":"techniques/enterprise/T1552.007/"}],"data_path":"data/detection-rules/6ad91e31-53df-4826-bd27-0166171c8040.json","kind":"sigma"}