Scheduled Task/Job: Container Orchestration Job T1053.007
Tactics: Execution, Persistence, Privilege Escalation
Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.
Authoring guide
These 4 rules share fields, values, and exclusions.
Fields filtered most (11 distinct)
These fields appear most often in rule filters.
Top indicator values (43 distinct)
These values appear most often in rule predicates.
Exclusions (17 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.