Sigma medium test sigma

Kubernetes CronJob/Job Modification

Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.

View Source

Detection Logic

{
  "selection": {
    "objectRef.apiGroup": "batch",
    "objectRef.resource": [
      "cronjobs",
      "jobs"
    ],
    "verb": [
      "create",
      "delete",
      "patch",
      "replace",
      "update"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ Modifying a Kubernetes Job or CronJob may need to be done by a system administrator.
⚠ Automated processes may need to take these actions and may need to be filtered.

Field Validations

Loading…

Comments (0)

Loading comments...