Google Cloud Kubernetes Admission Controller

 1title: Google Cloud Kubernetes Admission Controller
 2id: 6ad91e31-53df-4826-bd27-0166171c8040
 3status: test
 4description: |
 5  Identifies when an admission controller is executed in GCP Kubernetes.
 6  A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
 7  The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
 8  An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
 9  For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
10  An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.  
11references:
12    - https://cloud.google.com/kubernetes-engine/docs
13author: Austin Songer @austinsonger
14date: 2021-11-25
15modified: 2022-12-18
16tags:
17    - attack.persistence
18    - attack.t1078
19    - attack.credential-access
20    - attack.t1552
21    - attack.t1552.007
22logsource:
23    product: gcp
24    service: gcp.audit
25detection:
26    selection:
27        gcp.audit.method_name|startswith: 'admissionregistration.k8s.io.v'
28        gcp.audit.method_name|contains:
29            - '.mutatingwebhookconfigurations.'
30            - '.validatingwebhookconfigurations.'
31        gcp.audit.method_name|endswith:
32            - 'create'
33            - 'patch'
34            - 'replace'
35    condition: selection
36falsepositives:
37    - Google Cloud Kubernetes Admission Controller may be done by a system administrator.
38    - If known behavior is causing false positives, it can be exempted from the rule.
39level: medium