Azure Kubernetes Admission Controller

calendar Oct 17, 2023 · attack.persistence attack.t1078 attack.credential_access attack.t1552 attack.t1552.007  ·
Share on: linkedin copy

Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Sigma rule (View on GitHub)

 1title: Azure Kubernetes Admission Controller
 2id: a61a3c56-4ce2-4351-a079-88ae4cbd2b58
 3status: test
 4description: |
 5  Identifies when an admission controller is executed in Azure Kubernetes.
 6  A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
 7  The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
 8  An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
 9  For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
10  An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
11  An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.  
12references:
13    - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
14author: Austin Songer @austinsonger
15date: 2021/11/25
16modified: 2022/12/18
17tags:
18    - attack.persistence
19    - attack.t1078
20    - attack.credential_access
21    - attack.t1552
22    - attack.t1552.007
23logsource:
24    product: azure
25    service: activitylogs
26detection:
27    selection:
28        operationName|startswith:
29            - 'MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO'
30            - 'MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO'
31        operationName|endswith:
32            - '/MUTATINGWEBHOOKCONFIGURATIONS/WRITE'
33            - '/VALIDATINGWEBHOOKCONFIGURATIONS/WRITE'
34    condition: selection
35falsepositives:
36    - Azure Kubernetes Admissions Controller may be done by a system administrator.
37    - If known behavior is causing false positives, it can be exempted from the rule.
38level: medium

References

Related rules

to-top