Sigma rule: Google Cloud Kubernetes Admission Controller

A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-7041877a12ed, updated 2022-12-18T00:00:00.000Z.

Rule

Title
Google Cloud Kubernetes Admission Controller
Status
test
Level
medium
Author
Austin Songer @austinsonger
Date
2021-11-25
Modified
2022-12-18
File
rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml
Commit
ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies when an admission controller is executed in GCP Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Log source

product
gcp
service
gcp.audit

Detection

selection:
    gcp.audit.method_name|startswith: 'admissionregistration.k8s.io.v'
    gcp.audit.method_name|contains:
        - '.mutatingwebhookconfigurations.'
        - '.validatingwebhookconfigurations.'
    gcp.audit.method_name|endswith:
        - 'create'
        - 'patch'
        - 'replace'
condition: selection

False positives (as the rule lists them)

  • Google Cloud Kubernetes Admission Controller may be done by a system administrator.
  • If known behavior is causing false positives, it can be exempted from the rule.

Tags

  • attack.privilege-escalation
  • attack.initial-access
  • attack.persistence
  • attack.stealth
  • attack.t1078
  • attack.credential-access
  • attack.t1552
  • attack.t1552.007

MITRE ATT&CK ids this rule names

References

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml

Sources and licences

  • SigmaHQ

    "Google Cloud Kubernetes Admission Controller" by Austin Songer @austinsonger (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml.
    Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License

    Detection Rule License (DRL) 1.1

Cite this page

Dragons Eye Ransomware Tracker, "Sigma rule: Google Cloud Kubernetes Admission Controller",
entity page, dataset version ref-7041877a12ed, updated 2022-12-18T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/6ad91e31-53df-4826-bd27-0166171c8040 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 6ad91e31-53df-4826-bd27-0166171c8040, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.

Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.