{"id":"eed82177-38f5-4299-8a76-098d50d225ab","title":"Kubernetes Admission Controller Modification","description":"Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.\n","author":"kelnage","status":"test","level":"medium","date":"2024-07-11","modified":"","tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.credential-access","attack.t1552","attack.t1552.007"],"technique_ids":["T1078","T1552","T1552.007"],"logsource":{"product":"kubernetes","service":"audit"},"falsepositives":["Modifying the Kubernetes Admission Controller may need to be done by a system administrator.","Automated processes may need to take these actions and may need to be filtered."],"references":["https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/","https://security.padok.fr/en/blog/kubernetes-webhook-attackers"],"source_path":"rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml","source_sha256":"94107efc242ec4a8fc2b5bc2b6e175ddf70ad3791c8e2317c777ff112455a310","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Kubernetes Admission Controller Modification\nid: eed82177-38f5-4299-8a76-098d50d225ab\nrelated:\n    - id: 6ad91e31-53df-4826-bd27-0166171c8040\n      type: similar\nstatus: test\ndescription: |\n    Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.\nreferences:\n    - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/\n    - https://security.padok.fr/en/blog/kubernetes-webhook-attackers\nauthor: kelnage\ndate: 2024-07-11\ntags:\n    - attack.privilege-escalation\n    - attack.initial-access\n    - attack.persistence\n    - attack.stealth\n    - attack.t1078\n    - attack.credential-access\n    - attack.t1552\n    - attack.t1552.007\nlogsource:\n    product: kubernetes\n    service: audit\ndetection:\n    selection:\n        objectRef.apiGroup: 'admissionregistration.k8s.io'\n        objectRef.resource:\n            - 'mutatingwebhookconfigurations'\n            - 'validatingwebhookconfigurations'\n        verb:\n            - 'create'\n            - 'delete'\n            - 'patch'\n            - 'replace'\n            - 'update'\n    condition: selection\nfalsepositives:\n    - Modifying the Kubernetes Admission Controller may need to be done by a system administrator.\n    - Automated processes may need to take these actions and may need to be filtered.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1078","id":"T1078","name":"Valid Accounts","page":"techniques/enterprise/T1078/"},{"key":"enterprise/T1552","id":"T1552","name":"Unsecured Credentials","page":"techniques/enterprise/T1552/"},{"key":"enterprise/T1552.007","id":"T1552.007","name":"Container API","page":"techniques/enterprise/T1552.007/"}],"data_path":"data/detection-rules/eed82177-38f5-4299-8a76-098d50d225ab.json","kind":"sigma"}