detection.wiki

MutatingWebhookConfigurations

OperationDescriptionSampleRule
get-mutatingwebhookconfigurationsYN
list-mutatingwebhookconfigurationsYN
watch-mutatingwebhookconfigurationsYN
create-mutatingwebhookconfigurationsMutatingWebhookConfiguration created (admission controller modification; persistence or defense evasion).YY
update-mutatingwebhookconfigurationsModifies an existing MutatingWebhookConfiguration, e.g. its clientConfig.url or failurePolicy. Sigma and Elastic both track update as an admission-controller change.YY
patch-mutatingwebhookconfigurationsSame admission-controller change as update, via patch. Sigma and Elastic both track this verb on mutating and validating webhook configurations together.YY
delete-mutatingwebhookconfigurationsRemoves a MutatingWebhookConfiguration, disabling its request rewriting. Sigma and Elastic's admission-controller rules both track deletion this way.YY
deletecollection-mutatingwebhookconfigurationsYN
any-mutatingwebhookconfigurationsSynthetic aggregation for rules that filter the mutatingwebhookconfigurations resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.NN

get mutatingwebhookconfigurations

#
Resource
mutatingwebhookconfigurations

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/dw-harn-mutatingwebhookconfigurations",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "mutatingwebhookconfigurations",
    "name": "dw-harn-mutatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:38.265974Z",
  "stageTimestamp": "2026-07-02T04:48:38.267360Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

list mutatingwebhookconfigurations

#
Resource
mutatingwebhookconfigurations

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations?limit=500&timeout=3s",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "mutatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:38.387014Z",
  "stageTimestamp": "2026-07-02T04:48:38.388598Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

watch mutatingwebhookconfigurations

#
Resource
mutatingwebhookconfigurations

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations?resourceVersion=1734&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "mutatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:38.389829Z",
  "stageTimestamp": "2026-07-02T04:48:41.390121Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

create mutatingwebhookconfigurations

#
Resource
mutatingwebhookconfigurations

Description

MutatingWebhookConfiguration created (admission controller modification; persistence or defense evasion).

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "mutatingwebhookconfigurations",
    "name": "dw-harn-mutatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "MutatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-mutatingwebhookconfigurations"
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ],
        "reinvocationPolicy": "Never"
      }
    ]
  },
  "responseObject": {
    "kind": "MutatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-mutatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1734",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:48:38Z"
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ],
        "reinvocationPolicy": "Never"
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:38.203171Z",
  "stageTimestamp": "2026-07-02T04:48:38.208032Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
verbeqcreate3 rulespanther, sigma
verb (sigma rule field)eqdelete1 rulesigma
verb (sigma rule field)eqpatch1 rulesigma
verb (sigma rule field)eqreplace1 rulesigma
verb (sigma rule field)equpdate1 rulesigma
username (panther rule field)containsserviceaccount1 rulepanther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GKE Admission Webhook Created or Modified source medium: Detects creation or modification of GKE mutating or validating admission webhook configurations by non-system identities. Malicious webhooks can inject workloads, block security tooling, or intercept API traffic for persistence and defense evasion.T1546, T1562↳ also matches update-mutatingwebhookconfigurations: update mutatingwebhookconfigurations, patch-mutatingwebhookconfigurations: patch mutatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating GKE Admission Webhook Created or Modified#

    Review webhook name, actor, and clientConfig destination in gcp.audit.request.

    Investigation steps#

    • Confirm user.email, event.action, and webhook resource name.
    • Inspect webhook URL or in-cluster service target for external endpoints.
    • Hunt for pod mutations or blocked security deployments after the change.

    False positives#

    • Approved controller upgrades during change windows.

    Setup#

    The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

  • Kubernetes Admission Webhook Created or Modified source medium: Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.T1546, T1562↳ also matches update-mutatingwebhookconfigurations: update mutatingwebhookconfigurations, patch-mutatingwebhookconfigurations: patch mutatingwebhookconfigurations, delete-mutatingwebhookconfigurations: delete mutatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Admission Webhook Created or Modified#

    Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars, alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

    Possible investigation steps#

    • Confirm the webhook resource and operation:
      • kubernetes.audit.objectRef.resource and kubernetes.audit.verb
      • kubernetes.audit.objectRef.name (the webhook configuration name)
    • Attribute the actor and access path:
      • user.name (human vs service account vs node identity)
      • source.ip and user_agent.original
      • In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
    • Extract the webhook destination and review for external exfiltration:
      • kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
      • kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
    • Review impact-driving webhook settings:
      • failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
      • namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
      • rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
      • sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
    • Scope blast radius and follow-on activity:
      • Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars, volume mounts, or securityContext changes.
      • Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

    False positive analysis#

    • GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
      • approved Helm/Git commits, change tickets, and expected controller namespaces
      • known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

    Response and remediation#

    • If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the actor identity and rotate any credentials it used.
    • If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from trusted manifests/images, and validate that new pods are no longer being mutated.
    • If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the destination around the alert window.

Panther #

  • Kubernetes Admission Controller Webhook Created source medium: This detection monitors for creation of MutatingWebhookConfiguration or ValidatingWebhookConfiguration resources. Admission controller webhooks can intercept all API requests to the Kubernetes API server, allowing attackers to inspect, modify, or block any resource creation or modification. This provides powerful capabilities for persistence (modifying deployments to inject backdoors), credential theft (intercepting secrets), and reconnaissance (enumerating all cluster activity).T1530, T1546, T1552
  • New Admission Controller Created source medium linked query: New Admission Controller Created: This detection monitors for a new admission controller being created in the cluster. Admission controllers allows an attack to intercept all API requests made within a cluster, allowing for enumeration of resources and common actions. This can be a very powerful tool to understand where to pivot to next.
  • New Admission Controller Created source: This detection monitors for a new admission controller being created in the cluster. Admission controllers allows an attack to intercept all API requests made within a cluster, allowing for enumeration of resources and common actions. This can be a very powerful tool to understand where to pivot to next.

References #

update mutatingwebhookconfigurations

#
Resource
mutatingwebhookconfigurations

Description

Modifies an existing MutatingWebhookConfiguration, e.g. its clientConfig.url or failurePolicy. Sigma and Elastic both track update as an admission-controller change.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/dw-harn-mutatingwebhookconfigurations?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "mutatingwebhookconfigurations",
    "name": "dw-harn-mutatingwebhookconfigurations",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "933"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "MutatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-mutatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "933",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:32:17Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ],
        "reinvocationPolicy": "Never"
      }
    ]
  },
  "responseObject": {
    "kind": "MutatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-mutatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "933",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:32:17Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ],
        "reinvocationPolicy": "Never"
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:21.104964Z",
  "stageTimestamp": "2026-07-02T21:32:21.107594Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
verb (sigma rule field)eqdelete1 rulesigma
verb (sigma rule field)eqpatch1 rulesigma
verb (sigma rule field)eqreplace1 rulesigma
verb (sigma rule field)equpdate1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GKE Admission Webhook Created or Modified source medium: Detects creation or modification of GKE mutating or validating admission webhook configurations by non-system identities. Malicious webhooks can inject workloads, block security tooling, or intercept API traffic for persistence and defense evasion.T1546, T1562↳ also matches create-mutatingwebhookconfigurations: create mutatingwebhookconfigurations, patch-mutatingwebhookconfigurations: patch mutatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating GKE Admission Webhook Created or Modified#

    Review webhook name, actor, and clientConfig destination in gcp.audit.request.

    Investigation steps#

    • Confirm user.email, event.action, and webhook resource name.
    • Inspect webhook URL or in-cluster service target for external endpoints.
    • Hunt for pod mutations or blocked security deployments after the change.

    False positives#

    • Approved controller upgrades during change windows.

    Setup#

    The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

  • Kubernetes Admission Webhook Created or Modified source medium: Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.T1546, T1562↳ also matches create-mutatingwebhookconfigurations: create mutatingwebhookconfigurations, patch-mutatingwebhookconfigurations: patch mutatingwebhookconfigurations, delete-mutatingwebhookconfigurations: delete mutatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Admission Webhook Created or Modified#

    Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars, alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

    Possible investigation steps#

    • Confirm the webhook resource and operation:
      • kubernetes.audit.objectRef.resource and kubernetes.audit.verb
      • kubernetes.audit.objectRef.name (the webhook configuration name)
    • Attribute the actor and access path:
      • user.name (human vs service account vs node identity)
      • source.ip and user_agent.original
      • In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
    • Extract the webhook destination and review for external exfiltration:
      • kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
      • kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
    • Review impact-driving webhook settings:
      • failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
      • namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
      • rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
      • sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
    • Scope blast radius and follow-on activity:
      • Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars, volume mounts, or securityContext changes.
      • Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

    False positive analysis#

    • GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
      • approved Helm/Git commits, change tickets, and expected controller namespaces
      • known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

    Response and remediation#

    • If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the actor identity and rotate any credentials it used.
    • If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from trusted manifests/images, and validate that new pods are no longer being mutated.
    • If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the destination around the alert window.

References #

patch mutatingwebhookconfigurations

#
Resource
mutatingwebhookconfigurations

Description

Same admission-controller change as update, via patch. Sigma and Elastic both track this verb on mutating and validating webhook configurations together.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/dw-harn-mutatingwebhookconfigurations?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "mutatingwebhookconfigurations",
    "name": "dw-harn-mutatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "MutatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-mutatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1740",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:48:38Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ],
        "reinvocationPolicy": "Never"
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:41.455737Z",
  "stageTimestamp": "2026-07-02T04:48:41.460260Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
verb (sigma rule field)eqpatch1 rulesigma
verb (sigma rule field)eqreplace1 rulesigma
verb (sigma rule field)equpdate1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GKE Admission Webhook Created or Modified source medium: Detects creation or modification of GKE mutating or validating admission webhook configurations by non-system identities. Malicious webhooks can inject workloads, block security tooling, or intercept API traffic for persistence and defense evasion.T1546, T1562↳ also matches create-mutatingwebhookconfigurations: create mutatingwebhookconfigurations, update-mutatingwebhookconfigurations: update mutatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating GKE Admission Webhook Created or Modified#

    Review webhook name, actor, and clientConfig destination in gcp.audit.request.

    Investigation steps#

    • Confirm user.email, event.action, and webhook resource name.
    • Inspect webhook URL or in-cluster service target for external endpoints.
    • Hunt for pod mutations or blocked security deployments after the change.

    False positives#

    • Approved controller upgrades during change windows.

    Setup#

    The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

  • Kubernetes Admission Webhook Created or Modified source medium: Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.T1546, T1562↳ also matches create-mutatingwebhookconfigurations: create mutatingwebhookconfigurations, update-mutatingwebhookconfigurations: update mutatingwebhookconfigurations, delete-mutatingwebhookconfigurations: delete mutatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Admission Webhook Created or Modified#

    Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars, alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

    Possible investigation steps#

    • Confirm the webhook resource and operation:
      • kubernetes.audit.objectRef.resource and kubernetes.audit.verb
      • kubernetes.audit.objectRef.name (the webhook configuration name)
    • Attribute the actor and access path:
      • user.name (human vs service account vs node identity)
      • source.ip and user_agent.original
      • In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
    • Extract the webhook destination and review for external exfiltration:
      • kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
      • kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
    • Review impact-driving webhook settings:
      • failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
      • namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
      • rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
      • sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
    • Scope blast radius and follow-on activity:
      • Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars, volume mounts, or securityContext changes.
      • Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

    False positive analysis#

    • GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
      • approved Helm/Git commits, change tickets, and expected controller namespaces
      • known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

    Response and remediation#

    • If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the actor identity and rotate any credentials it used.
    • If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from trusted manifests/images, and validate that new pods are no longer being mutated.
    • If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the destination around the alert window.

References #

delete mutatingwebhookconfigurations

#
Resource
mutatingwebhookconfigurations

Description

Removes a MutatingWebhookConfiguration, disabling its request rewriting. Sigma and Elastic's admission-controller rules both track deletion this way.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations/dw-harn-mutatingwebhookconfigurations",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "mutatingwebhookconfigurations",
    "name": "dw-harn-mutatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-mutatingwebhookconfigurations",
      "group": "admissionregistration.k8s.io",
      "kind": "mutatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-mutatingwebhookconfigurations",
      "group": "admissionregistration.k8s.io",
      "kind": "mutatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:41.522879Z",
  "stageTimestamp": "2026-07-02T04:48:41.526447Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
verb (sigma rule field)eqpatch1 rulesigma
verb (sigma rule field)eqreplace1 rulesigma
verb (sigma rule field)equpdate1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • Kubernetes Admission Webhook Created or Modified source medium: Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.T1546, T1562↳ also matches create-mutatingwebhookconfigurations: create mutatingwebhookconfigurations, update-mutatingwebhookconfigurations: update mutatingwebhookconfigurations, patch-mutatingwebhookconfigurations: patch mutatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Admission Webhook Created or Modified#

    Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars, alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

    Possible investigation steps#

    • Confirm the webhook resource and operation:
      • kubernetes.audit.objectRef.resource and kubernetes.audit.verb
      • kubernetes.audit.objectRef.name (the webhook configuration name)
    • Attribute the actor and access path:
      • user.name (human vs service account vs node identity)
      • source.ip and user_agent.original
      • In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
    • Extract the webhook destination and review for external exfiltration:
      • kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
      • kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
    • Review impact-driving webhook settings:
      • failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
      • namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
      • rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
      • sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
    • Scope blast radius and follow-on activity:
      • Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars, volume mounts, or securityContext changes.
      • Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

    False positive analysis#

    • GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
      • approved Helm/Git commits, change tickets, and expected controller namespaces
      • known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

    Response and remediation#

    • If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the actor identity and rotate any credentials it used.
    • If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from trusted manifests/images, and validate that new pods are no longer being mutated.
    • If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the destination around the alert window.

References #

deletecollection mutatingwebhookconfigurations

#
Resource
mutatingwebhookconfigurations

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "mutatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "MutatingWebhookConfigurationList",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "resourceVersion": "1147"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-mutatingwebhookconfigurations",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1147",
          "generation": 1,
          "creationTimestamp": "2026-07-02T23:14:32Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "webhooks": [
          {
            "name": "dw-harn.example.com",
            "clientConfig": {
              "url": "https://127.0.0.1:1/hook"
            },
            "rules": [
              {
                "operations": [
                  "CREATE"
                ],
                "apiGroups": [
                  ""
                ],
                "apiVersions": [
                  "v1"
                ],
                "resources": [
                  "pods"
                ],
                "scope": "*"
              }
            ],
            "failurePolicy": "Fail",
            "matchPolicy": "Equivalent",
            "namespaceSelector": {},
            "objectSelector": {},
            "sideEffects": "None",
            "timeoutSeconds": 10,
            "admissionReviewVersions": [
              "v1"
            ],
            "reinvocationPolicy": "Never"
          }
        ]
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:14:35.589946Z",
  "stageTimestamp": "2026-07-02T23:14:35.595031Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

any verb on mutatingwebhookconfigurations (synthetic aggregation)

#
Resource
mutatingwebhookconfigurations

Description

Synthetic aggregation for rules that filter the mutatingwebhookconfigurations resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.