Kubernetes Admission Controller Modification — Sigma Rule

Rule metadata and linked tags

Author: kelnage. Source status: test; severity: medium. Source dates: 2024-07-11 / not supplied.

{
  "product": "kubernetes",
  "service": "audit"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 94107efc242ec4a8fc2b5bc2b6e175ddf70ad3791c8e2317c777ff112455a310

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Kubernetes Admission Controller Modification
id: eed82177-38f5-4299-8a76-098d50d225ab
related:
    - id: 6ad91e31-53df-4826-bd27-0166171c8040
      type: similar
status: test
description: |
    Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
references:
    - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
    - https://security.padok.fr/en/blog/kubernetes-webhook-attackers
author: kelnage
date: 2024-07-11
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.persistence
    - attack.stealth
    - attack.t1078
    - attack.credential-access
    - attack.t1552
    - attack.t1552.007
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        objectRef.apiGroup: 'admissionregistration.k8s.io'
        objectRef.resource:
            - 'mutatingwebhookconfigurations'
            - 'validatingwebhookconfigurations'
        verb:
            - 'create'
            - 'delete'
            - 'patch'
            - 'replace'
            - 'update'
    condition: selection
falsepositives:
    - Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
    - Automated processes may need to take these actions and may need to be filtered.
level: medium

Original YAML and metadata in JSON

False positives

• Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
• Automated processes may need to take these actions and may need to be filtered.

Source references

• https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
• https://security.padok.fr/en/blog/kubernetes-webhook-attackers