Query: Sigma YAML for azure / activitylogs
Matching passage: Sigma rule: Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, a. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Admission Controller id: a61a3c56-4ce2-4351-a079-88ae4cbd2b58 status: test description: 'Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes author: Austin Songer @austinsonger date: 2021-11-25 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.credential-access - attack.t1552 - attack.t1552.007 logsource: product: azure service: activitylogs detection: selection: operationName|startswith: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO - MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO operationName|endswith: - /MUTATINGWEBHOOKCONFIGURATIONS/WRITE - /VALIDATINGWEBHOOKCONFIGURATIONS/WRITE condition: selection falsepositives: - Azure Kubernetes Admissions Controller may be done by a system administrator. - If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it f. Logsource: windows / registry_delete. Rule: title: Removal Of Index Value to Hide Schedule Task - Registry id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec related: - id: acd74772-5f88-45c7-956b-6a7b36c294d2 type: similar - id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61 type: similar status: test description: Detects when the "index" value of a scheduled task is removed or deleted from the registry. Which effectively hides it from any tooling such as "schtasks /query" references: - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-26 modified: 2025-10-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_delete detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - Index condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal/info.yml