mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Samirbous
5ecede016d
* [New] Kubernetes Admission Webhook Created or Modified
Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations
by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an
attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security
tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic.
* Update non-ecs-schema.json
* ++
* Update persistence_kubernetes_admission_webhook_created_or_modified.toml
(cherry picked from commit 4bf05609f3)