Sigma rule: Azure Kubernetes Admission Controller

Rule

Title

Azure Kubernetes Admission Controller

Status

test

Level

medium

Author

Austin Songer @austinsonger

Date

2021-11-25

Modified

2022-12-18

File

rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies when an admission controller is executed in Azure Kubernetes.
A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.
The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.
An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.
For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.
An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.
An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.

Log source

product

azure

service

activitylogs

Detection

selection:
    operationName|startswith:
        - 'MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO'
        - 'MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO'
    operationName|endswith:
        - '/MUTATINGWEBHOOKCONFIGURATIONS/WRITE'
        - '/VALIDATINGWEBHOOKCONFIGURATIONS/WRITE'
condition: selection

False positives (as the rule lists them)

• Azure Kubernetes Admissions Controller may be done by a system administrator.
• If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.privilege-escalation
• attack.initial-access
• attack.persistence
• attack.stealth
• attack.t1078
• attack.credential-access
• attack.t1552
• attack.t1552.007

MITRE ATT&CK ids this rule names

• T1078
• T1552
• T1552.007

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml