Techniques › T1053.007 › AN0582
AN0582 Analytic 0582
Containers · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects abuse of container orchestration platforms (e.g., Kubernetes) where adversaries create CronJobs to maintain persistence or execute malicious Jobs across the cluster.</p>
- Detects
- T1053.007 Container Orchestration Job
- Part of
- DET0206 Detection of Malicious Kubernetes CronJob Scheduling
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| kubernetes:apiserver | verb=create, resource=cronjobs, group=batch | DC0001 Scheduled Job Creation |
| kubernetes:events | container start/stop activity via Docker, containerd, or CRI-O | DC0072 Container Creation |
| container:proxy | outbound/inbound network activity from spawned pods | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
NamespaceScope | Kubernetes namespace the job is deployed to—scoping this to known trusted namespaces may reduce noise. |
ImageRepository | The container image registry or repository the job pulls from—can be filtered by trusted registries. |
ScheduleWindow | Time window or frequency of CronJob execution (e.g., ‘@hourly’)—jobs running at odd hours may be suspicious. |
ExecutionCommand | The command or entrypoint executed by the Job—unexpected shell commands or interpreters may warrant inspection. |