Detectionmediumtest

Kubernetes CronJob/Job Modification

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

kelnageCreated Thu Jul 110c9b3bda-41a6-4442-9345-356ae86343dcapplication

Log Source

Kubernetesaudit

ProductKubernetes← raw: kubernetes

Serviceaudit← raw: audit

Detection Logic

detection:
    selection:
        objectRef.apiGroup: 'batch'
        objectRef.resource:
            - 'cronjobs'
            - 'jobs'
        verb:
            - 'create'
            - 'delete'
            - 'patch'
            - 'replace'
            - 'update'
    condition: selection

False Positives

Modifying a Kubernetes Job or CronJob may need to be done by a system administrator.

Automated processes may need to take these actions and may need to be filtered.

References

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0004 · Privilege Escalation TA0002 · Execution

Related Rules

SimilarDetectionmedium

Google Cloud Kubernetes CronJob

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

0c9b3bda-41a6-4442-9345-356ae86343dc

Status

test

Level

medium

Type

Detection

Created

Thu Jul 11

Author

kelnage

Path

rules/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml

Raw Tags

attack.persistenceattack.privilege-escalationattack.execution

View on GitHub