Title:
Kubernetes Admission Controller Modification
Status:
test
Description:Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
References:
-https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
-https://security.padok.fr/en/blog/kubernetes-webhook-attackers
Author: kelnage
Date: 2024-07-11
modified:None
Tags:
- -'attack.privilege-escalation'
- -'attack.initial-access'
- -'attack.persistence'
- -'attack.stealth'
- -'attack.t1078'
- -'attack.credential-access'
- -'attack.t1552'
- -'attack.t1552.007'
Logsource:
- product: kubernetes
- service: audit
Detection:
selection:
objectRef.apiGroup:
'admissionregistration.k8s.io'
objectRef.resource:
-'mutatingwebhookconfigurations'
-'validatingwebhookconfigurations'
verb:
-'create'
-'delete'
-'patch'
-'replace'
-'update'
condition:
selection
Falsepositives:
-Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
-Automated processes may need to take these actions and may need to be filtered.
Level:
medium
