Detection rules › Sigma

Kubernetes Admission Controller Modification

Status
test
Severity
medium
Log source
product kubernetes, service audit
Author
kelnage
Source
github.com/SigmaHQ/sigma

Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1078 Valid Accounts
PersistenceT1078 Valid Accounts
Privilege EscalationT1078 Valid Accounts
StealthT1078 Valid Accounts
Credential AccessT1552.007 Unsecured Credentials: Container API

Event coverage

Rules detecting the same action

Other rules on this platform that filter on the same API call or operation.

Rule body yaml

title: Kubernetes Admission Controller Modification
id: eed82177-38f5-4299-8a76-098d50d225ab
related:
    - id: 6ad91e31-53df-4826-bd27-0166171c8040
      type: similar
status: test
description: |
    Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
references:
    - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
    - https://security.padok.fr/en/blog/kubernetes-webhook-attackers
author: kelnage
date: 2024-07-11
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.persistence
    - attack.stealth
    - attack.t1078
    - attack.credential-access
    - attack.t1552
    - attack.t1552.007
logsource:
    product: kubernetes
    service: audit
detection:
    selection:
        objectRef.apiGroup: 'admissionregistration.k8s.io'
        objectRef.resource:
            - 'mutatingwebhookconfigurations'
            - 'validatingwebhookconfigurations'
        verb:
            - 'create'
            - 'delete'
            - 'patch'
            - 'replace'
            - 'update'
    condition: selection
falsepositives:
    - Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
    - Automated processes may need to take these actions and may need to be filtered.
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    objectRef.apiGroup: 'admissionregistration.k8s.io'
    objectRef.resource:
        - 'mutatingwebhookconfigurations'
        - 'validatingwebhookconfigurations'
    verb:
        - 'create'
        - 'delete'
        - 'patch'
        - 'replace'
        - 'update'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
objectRef.apiGroupeq
  • admissionregistration.k8s.io
objectRef.resourceeq
  • mutatingwebhookconfigurations
  • validatingwebhookconfigurations
verbeq
  • create
  • delete
  • patch
  • replace
  • update