Kubernetes Admission Controller Webhook Created

Description

This detection monitors for creation of MutatingWebhookConfiguration or ValidatingWebhookConfiguration resources. Admission controller webhooks can intercept all API requests to the Kubernetes API server, allowing attackers to inspect, modify, or block any resource creation or modification. This provides powerful capabilities for persistence (modifying deployments to inject backdoors), credential theft (intercepting secrets), and reconnaissance (enumerating all cluster activity).

Query · python

from panther_kubernetes_helpers import is_failed_request, is_system_principal, k8s_alert_context

# Admission controller webhook resource types
WEBHOOK_RESOURCES = {
    "mutatingwebhookconfigurations",
    "validatingwebhookconfigurations",
}


def rule(event):
    verb = event.udm("verb")
    resource = event.udm("resource")
    response_status = event.udm("responseStatus")

    # Only check webhook creation events
    if verb != "create":
        return False

    if resource not in WEBHOOK_RESOURCES:
        return False

    # Skip failed requests
    if is_failed_request(response_status):
        return False

    # Exclude noise from cluster maintenance
    username = event.udm("username")
    if is_system_principal(username):
        return False

    # Alert on any admission controller webhook creation
    return True


def title(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    resource = event.udm("resource") or "webhook"
    name = event.udm("name") or "<UNKNOWN_NAME>"

    webhook_type = "Mutating" if "mutating" in resource.lower() else "Validating"

    return f"[{username}] created {webhook_type} admission controller webhook [{name}] "


def dedup(event):
    username = event.udm("username") or "<UNKNOWN_USER>"
    return f"k8s_admission_webhook_{username}"


def severity(event):
    """Increase severity for webhooks that intercept all resources."""
    webhooks = event.udm("webhooks") or []

    for webhook in webhooks:
        rules = webhook.get("rules", [])
        for rule_config in rules:
            resources = rule_config.get("resources", [])
            api_groups = rule_config.get("apiGroups", [])

            # Check for wildcard rules that intercept everything
            if "*" in resources or "*" in api_groups:
                return "HIGH"

    return "MEDIUM"


def alert_context(event):
    webhooks = event.udm("webhooks") or []

    # Extract webhook details
    webhook_details = []
    for webhook in webhooks:
        client_config = webhook.get("clientConfig", {})
        webhook_details.append(
            {
                "name": webhook.get("name"),
                "url": client_config.get("url"),
                "service": client_config.get("service"),
                "failure_policy": webhook.get("failurePolicy"),
                "rules": webhook.get("rules", []),
            }
        )

    return k8s_alert_context(
        event,
        extra_fields={
            "webhook_name": event.udm("name"),
            "webhook_type": event.udm("resource"),
            "webhooks": webhook_details,
        },
    )

Analyst notes

Review the webhook configuration details including the target webhook service URL and failure policy
Identify all API operations performed by the username in the 48 hours before webhook creation to establish intent
Search for other webhook configurations or suspicious API activity from this user across all clusters in the past 7 days

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Stable
Query type: python
Created: 2026-02-17
Modified: 2026-04-07
Authored by: panther-labs
Source ID
Upstream: rules/kubernetes_rules/k8s_admission_controller_created.yml
Type: rule
Version: 2
References: https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/
Data sources: Amazon.EKS.AuditAzure.MonitorActivityGCP.AuditLog

ATT&CK

TA0003TA0006TA0009 T1530 T1546 T1552