Cross-source coverage
T1053.007 / ATT&CK
Scheduled Task/Job: Container Orchestration Job
4 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.
In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks. An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.
- Tactics
- Execution · Persistence · Privilege Escalation
- Platforms
- Containers
- Telemetry
-
kubernetes:apiserverkubernetes:eventscontainer:proxy
How MITRE says to detect it DET0206
Detection of Malicious Kubernetes CronJob Scheduling
Containers Analytic 0582
Detects abuse of container orchestration platforms (e.g., Kubernetes) where adversaries create CronJobs to maintain persistence or execute malicious Jobs across the cluster.
kubernetes:apiserververb=create, resource=cronjobs, group=batchkubernetes:eventscontainer start/stop activity via Docker, containerd, or CRI-Ocontainer:proxyoutbound/inbound network activity from spawned pods
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Kubernetes Sensitive Configuration File Activity | Medium | Elastic TOML |
| Kubernetes Static Pod Manifest File Access | Medium | Elastic TOML |
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| Cisco Isovalent - Cron Job Creation | Undefined | SPL |
| Kubernetes Cron Job Creation | Undefined | SPL |