<  Back to rules search

A new Kubernetes admission controller was created

kubernetes

Classification:

attack

Tactic:

Set up the kubernetes integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Identify when a new Kubernetes admission controller is created in the cluster.

Admission controllers can intercept all incoming requests to the API server. An attacker can use them to establish persistence or to access sensitive data (such as secrets) sent to the API server.

Strategy

This rule identifies when a MutatingWebhookConfiguration or ValidatingWebhookConfiguration is created.

Triage and response

  1. Determine if the admission controller being created is expected.
  2. Determine if the user: {{@usr.id}} should be creating the admission controller.
  3. Use the Cloud SIEM User Investigation dashboard to review user actions that occurred after the potentially malicious action.

Changelog

  • 20 September 2022 - Updated tags