detection.wiki

ValidatingWebhookConfigurations

OperationDescriptionSampleRule
get-validatingwebhookconfigurationsYN
list-validatingwebhookconfigurationsYN
watch-validatingwebhookconfigurationsYN
create-validatingwebhookconfigurationsValidatingWebhookConfiguration created or modified (admission controller change; defense evasion).YY
update-validatingwebhookconfigurationsModifies an existing ValidatingWebhookConfiguration, e.g. weakening failurePolicy to Ignore. Sigma and Elastic both track update as an admission-controller change.YY
patch-validatingwebhookconfigurationsSame admission-controller change as update, via patch. Sigma and Elastic both track this verb on mutating and validating webhook configurations together.YY
delete-validatingwebhookconfigurationsRemoves a ValidatingWebhookConfiguration, dropping whatever admission checks it enforced. Sigma/Elastic track this the same as create/update/patch.YY
deletecollection-validatingwebhookconfigurationsYN
any-validatingwebhookconfigurationsSynthetic aggregation for rules that filter the validatingwebhookconfigurations resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.NN

get validatingwebhookconfigurations

#
Resource
validatingwebhookconfigurations

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/dw-harn-validatingwebhookconfigurations",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "validatingwebhookconfigurations",
    "name": "dw-harn-validatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:34.841977Z",
  "stageTimestamp": "2026-07-02T04:48:34.843212Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

list validatingwebhookconfigurations

#
Resource
validatingwebhookconfigurations

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations?limit=500&timeout=3s",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "validatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:34.968046Z",
  "stageTimestamp": "2026-07-02T04:48:34.969452Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

watch validatingwebhookconfigurations

#
Resource
validatingwebhookconfigurations

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations?resourceVersion=1726&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "validatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:34.970517Z",
  "stageTimestamp": "2026-07-02T04:48:37.971032Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

create validatingwebhookconfigurations

#
Resource
validatingwebhookconfigurations

Description

ValidatingWebhookConfiguration created or modified (admission controller change; defense evasion).

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "validatingwebhookconfigurations",
    "name": "dw-harn-validatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "ValidatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-validatingwebhookconfigurations"
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ]
      }
    ]
  },
  "responseObject": {
    "kind": "ValidatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-validatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1726",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:48:34Z"
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ]
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:34.776589Z",
  "stageTimestamp": "2026-07-02T04:48:34.779980Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
username (panther rule field)containsserviceaccount1 rulepanther
verb (sigma rule field)eqpatch1 rulesigma
verb (sigma rule field)eqreplace1 rulesigma
verb (sigma rule field)equpdate1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GKE Admission Webhook Created or Modified source medium: Detects creation or modification of GKE mutating or validating admission webhook configurations by non-system identities. Malicious webhooks can inject workloads, block security tooling, or intercept API traffic for persistence and defense evasion.T1546, T1562↳ also matches update-validatingwebhookconfigurations: update validatingwebhookconfigurations, patch-validatingwebhookconfigurations: patch validatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating GKE Admission Webhook Created or Modified#

    Review webhook name, actor, and clientConfig destination in gcp.audit.request.

    Investigation steps#

    • Confirm user.email, event.action, and webhook resource name.
    • Inspect webhook URL or in-cluster service target for external endpoints.
    • Hunt for pod mutations or blocked security deployments after the change.

    False positives#

    • Approved controller upgrades during change windows.

    Setup#

    The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

  • Kubernetes Admission Webhook Created or Modified source medium: Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.T1546, T1562↳ also matches update-validatingwebhookconfigurations: update validatingwebhookconfigurations, patch-validatingwebhookconfigurations: patch validatingwebhookconfigurations, delete-validatingwebhookconfigurations: delete validatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Admission Webhook Created or Modified#

    Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars, alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

    Possible investigation steps#

    • Confirm the webhook resource and operation:
      • kubernetes.audit.objectRef.resource and kubernetes.audit.verb
      • kubernetes.audit.objectRef.name (the webhook configuration name)
    • Attribute the actor and access path:
      • user.name (human vs service account vs node identity)
      • source.ip and user_agent.original
      • In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
    • Extract the webhook destination and review for external exfiltration:
      • kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
      • kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
    • Review impact-driving webhook settings:
      • failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
      • namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
      • rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
      • sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
    • Scope blast radius and follow-on activity:
      • Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars, volume mounts, or securityContext changes.
      • Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

    False positive analysis#

    • GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
      • approved Helm/Git commits, change tickets, and expected controller namespaces
      • known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

    Response and remediation#

    • If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the actor identity and rotate any credentials it used.
    • If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from trusted manifests/images, and validate that new pods are no longer being mutated.
    • If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the destination around the alert window.

Panther #

  • Kubernetes Admission Controller Webhook Created source medium: This detection monitors for creation of MutatingWebhookConfiguration or ValidatingWebhookConfiguration resources. Admission controller webhooks can intercept all API requests to the Kubernetes API server, allowing attackers to inspect, modify, or block any resource creation or modification. This provides powerful capabilities for persistence (modifying deployments to inject backdoors), credential theft (intercepting secrets), and reconnaissance (enumerating all cluster activity).T1530, T1546, T1552

References #

update validatingwebhookconfigurations

#
Resource
validatingwebhookconfigurations

Description

Modifies an existing ValidatingWebhookConfiguration, e.g. weakening failurePolicy to Ignore. Sigma and Elastic both track update as an admission-controller change.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/dw-harn-validatingwebhookconfigurations?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "validatingwebhookconfigurations",
    "name": "dw-harn-validatingwebhookconfigurations",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "925"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "ValidatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-validatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "925",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:32:13Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ]
      }
    ]
  },
  "responseObject": {
    "kind": "ValidatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-validatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "925",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:32:13Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ]
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:17.424440Z",
  "stageTimestamp": "2026-07-02T21:32:17.426888Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
verb (sigma rule field)eqpatch1 rulesigma
verb (sigma rule field)eqreplace1 rulesigma
verb (sigma rule field)equpdate1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GKE Admission Webhook Created or Modified source medium: Detects creation or modification of GKE mutating or validating admission webhook configurations by non-system identities. Malicious webhooks can inject workloads, block security tooling, or intercept API traffic for persistence and defense evasion.T1546, T1562↳ also matches create-validatingwebhookconfigurations: create validatingwebhookconfigurations, patch-validatingwebhookconfigurations: patch validatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating GKE Admission Webhook Created or Modified#

    Review webhook name, actor, and clientConfig destination in gcp.audit.request.

    Investigation steps#

    • Confirm user.email, event.action, and webhook resource name.
    • Inspect webhook URL or in-cluster service target for external endpoints.
    • Hunt for pod mutations or blocked security deployments after the change.

    False positives#

    • Approved controller upgrades during change windows.

    Setup#

    The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

  • Kubernetes Admission Webhook Created or Modified source medium: Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.T1546, T1562↳ also matches create-validatingwebhookconfigurations: create validatingwebhookconfigurations, patch-validatingwebhookconfigurations: patch validatingwebhookconfigurations, delete-validatingwebhookconfigurations: delete validatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Admission Webhook Created or Modified#

    Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars, alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

    Possible investigation steps#

    • Confirm the webhook resource and operation:
      • kubernetes.audit.objectRef.resource and kubernetes.audit.verb
      • kubernetes.audit.objectRef.name (the webhook configuration name)
    • Attribute the actor and access path:
      • user.name (human vs service account vs node identity)
      • source.ip and user_agent.original
      • In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
    • Extract the webhook destination and review for external exfiltration:
      • kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
      • kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
    • Review impact-driving webhook settings:
      • failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
      • namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
      • rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
      • sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
    • Scope blast radius and follow-on activity:
      • Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars, volume mounts, or securityContext changes.
      • Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

    False positive analysis#

    • GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
      • approved Helm/Git commits, change tickets, and expected controller namespaces
      • known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

    Response and remediation#

    • If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the actor identity and rotate any credentials it used.
    • If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from trusted manifests/images, and validate that new pods are no longer being mutated.
    • If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the destination around the alert window.

References #

patch validatingwebhookconfigurations

#
Resource
validatingwebhookconfigurations

Description

Same admission-controller change as update, via patch. Sigma and Elastic both track this verb on mutating and validating webhook configurations together.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/dw-harn-validatingwebhookconfigurations?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "validatingwebhookconfigurations",
    "name": "dw-harn-validatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "ValidatingWebhookConfiguration",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-validatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1732",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:48:34Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "webhooks": [
      {
        "name": "dw-harn.example.com",
        "clientConfig": {
          "url": "https://127.0.0.1:1/hook"
        },
        "rules": [
          {
            "operations": [
              "CREATE"
            ],
            "apiGroups": [
              ""
            ],
            "apiVersions": [
              "v1"
            ],
            "resources": [
              "pods"
            ],
            "scope": "*"
          }
        ],
        "failurePolicy": "Fail",
        "matchPolicy": "Equivalent",
        "namespaceSelector": {},
        "objectSelector": {},
        "sideEffects": "None",
        "timeoutSeconds": 10,
        "admissionReviewVersions": [
          "v1"
        ]
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:38.046735Z",
  "stageTimestamp": "2026-07-02T04:48:38.052129Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
verb (sigma rule field)eqpatch1 rulesigma
verb (sigma rule field)eqreplace1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • GKE Admission Webhook Created or Modified source medium: Detects creation or modification of GKE mutating or validating admission webhook configurations by non-system identities. Malicious webhooks can inject workloads, block security tooling, or intercept API traffic for persistence and defense evasion.T1546, T1562↳ also matches create-validatingwebhookconfigurations: create validatingwebhookconfigurations, update-validatingwebhookconfigurations: update validatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating GKE Admission Webhook Created or Modified#

    Review webhook name, actor, and clientConfig destination in gcp.audit.request.

    Investigation steps#

    • Confirm user.email, event.action, and webhook resource name.
    • Inspect webhook URL or in-cluster service target for external endpoints.
    • Hunt for pod mutations or blocked security deployments after the change.

    False positives#

    • Approved controller upgrades during change windows.

    Setup#

    The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

  • Kubernetes Admission Webhook Created or Modified source medium: Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.T1546, T1562↳ also matches create-validatingwebhookconfigurations: create validatingwebhookconfigurations, update-validatingwebhookconfigurations: update validatingwebhookconfigurations, delete-validatingwebhookconfigurations: delete validatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Admission Webhook Created or Modified#

    Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars, alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

    Possible investigation steps#

    • Confirm the webhook resource and operation:
      • kubernetes.audit.objectRef.resource and kubernetes.audit.verb
      • kubernetes.audit.objectRef.name (the webhook configuration name)
    • Attribute the actor and access path:
      • user.name (human vs service account vs node identity)
      • source.ip and user_agent.original
      • In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
    • Extract the webhook destination and review for external exfiltration:
      • kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
      • kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
    • Review impact-driving webhook settings:
      • failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
      • namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
      • rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
      • sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
    • Scope blast radius and follow-on activity:
      • Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars, volume mounts, or securityContext changes.
      • Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

    False positive analysis#

    • GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
      • approved Helm/Git commits, change tickets, and expected controller namespaces
      • known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

    Response and remediation#

    • If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the actor identity and rotate any credentials it used.
    • If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from trusted manifests/images, and validate that new pods are no longer being mutated.
    • If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the destination around the alert window.

References #

delete validatingwebhookconfigurations

#
Resource
validatingwebhookconfigurations

Description

Removes a ValidatingWebhookConfiguration, dropping whatever admission checks it enforced. Sigma/Elastic track this the same as create/update/patch.

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations/dw-harn-validatingwebhookconfigurations",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "validatingwebhookconfigurations",
    "name": "dw-harn-validatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-validatingwebhookconfigurations",
      "group": "admissionregistration.k8s.io",
      "kind": "validatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-validatingwebhookconfigurations",
      "group": "admissionregistration.k8s.io",
      "kind": "validatingwebhookconfigurations",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:38.119730Z",
  "stageTimestamp": "2026-07-02T04:48:38.122824Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
verb (sigma rule field)eqpatch1 rulesigma
verb (sigma rule field)eqreplace1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • Kubernetes Admission Webhook Created or Modified source medium: Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.T1546, T1562↳ also matches create-validatingwebhookconfigurations: create validatingwebhookconfigurations, update-validatingwebhookconfigurations: update validatingwebhookconfigurations, patch-validatingwebhookconfigurations: patch validatingwebhookconfigurations
    Investigation guide

    Triage and analysis#

    Investigating Kubernetes Admission Webhook Created or Modified#

    Admission webhooks can mutate or validate resources before they are persisted. A malicious webhook can inject sidecars, alter securityContext, block defensive workloads, or exfiltrate pod specs. This rule alerts on allowed changes to MutatingWebhookConfiguration and ValidatingWebhookConfiguration objects by identities outside common system patterns.

    Possible investigation steps#

    • Confirm the webhook resource and operation:
      • kubernetes.audit.objectRef.resource and kubernetes.audit.verb
      • kubernetes.audit.objectRef.name (the webhook configuration name)
    • Attribute the actor and access path:
      • user.name (human vs service account vs node identity)
      • source.ip and user_agent.original
      • In cloud-managed clusters, map the identity to IAM/Entra principal data present in kubernetes.audit.user.extra.*.
    • Extract the webhook destination and review for external exfiltration:
      • kubernetes.audit.requestObject.webhooks.clientConfig.url (suspicious when pointing to the public internet)
      • kubernetes.audit.requestObject.webhooks.clientConfig.service.* (in-cluster service; still validate namespace/name)
    • Review impact-driving webhook settings:
      • failurePolicy (e.g., Ignore can make malicious webhooks stealthier by avoiding obvious outages)
      • namespaceSelector / objectSelector targeting (e.g., excluding kube-system while targeting everything else)
      • rules.operations and rules.resources (e.g., CREATE pods is consistent with broad sidecar injection)
      • sideEffects, timeoutSeconds, matchPolicy, reinvocationPolicy
    • Scope blast radius and follow-on activity:
      • Hunt for pods created/updated after the webhook change that include unexpected containers, initContainers, env vars, volume mounts, or securityContext changes.
      • Check for concurrent RBAC changes, token creation, or secret access from the same identity and source IP.

    False positive analysis#

    • GitOps upgrades or controller installs can legitimately change admission webhooks. Validate the change against:
      • approved Helm/Git commits, change tickets, and expected controller namespaces
      • known controller identities (cert-manager, Gatekeeper, Kyverno, service mesh controllers)

    Response and remediation#

    • If unauthorized, revert or delete the webhook configuration from a known-good source (GitOps/Helm), then block the actor identity and rotate any credentials it used.
    • If the webhook targeted pod creation, assume workload impact: identify affected namespaces/workloads, redeploy from trusted manifests/images, and validate that new pods are no longer being mutated.
    • If an external clientConfig.url was used, treat it as potential data exfiltration and review egress/DNS logs for the destination around the alert window.

References #

deletecollection validatingwebhookconfigurations

#
Resource
validatingwebhookconfigurations

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/admissionregistration.k8s.io/v1/validatingwebhookconfigurations?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "validatingwebhookconfigurations",
    "apiGroup": "admissionregistration.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "ValidatingWebhookConfigurationList",
    "apiVersion": "admissionregistration.k8s.io/v1",
    "metadata": {
      "resourceVersion": "1137"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-validatingwebhookconfigurations",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1136",
          "generation": 1,
          "creationTimestamp": "2026-07-02T23:14:28Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "webhooks": [
          {
            "name": "dw-harn.example.com",
            "clientConfig": {
              "url": "https://127.0.0.1:1/hook"
            },
            "rules": [
              {
                "operations": [
                  "CREATE"
                ],
                "apiGroups": [
                  ""
                ],
                "apiVersions": [
                  "v1"
                ],
                "resources": [
                  "pods"
                ],
                "scope": "*"
              }
            ],
            "failurePolicy": "Fail",
            "matchPolicy": "Equivalent",
            "namespaceSelector": {},
            "objectSelector": {},
            "sideEffects": "None",
            "timeoutSeconds": 10,
            "admissionReviewVersions": [
              "v1"
            ]
          }
        ]
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:14:31.924868Z",
  "stageTimestamp": "2026-07-02T23:14:31.929364Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

any verb on validatingwebhookconfigurations (synthetic aggregation)

#
Resource
validatingwebhookconfigurations

Description

Synthetic aggregation for rules that filter the validatingwebhookconfigurations resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.