mirror of
https://github.com/elastic/detection-rules
synced 2026-06-08 14:00:08 +00:00
Samirbous
4bf05609f3
* [New] Kubernetes Admission Webhook Created or Modified Detects creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities. Admission webhooks intercept every API request matching their rules before persistence, giving an attacker powerful capabilities: injecting malicious sidecars into every new pod via a mutating webhook, blocking security tooling deployments via a validating webhook, or silently exfiltrating pod specifications to an external server. Webhook manipulation is a stealthy persistence and defense evasion technique because the webhook configuration itself looks benign in kubectl output while actively modifying or intercepting all matching Kubernetes API traffic. * Update non-ecs-schema.json * ++ * Update persistence_kubernetes_admission_webhook_created_or_modified.toml