Scheduled Task/Job: Container Orchestration Job T1053.007

Tactics: Execution, Persistence, Privilege Escalation

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (11 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
host.os.type2eq 2
process_name2eq 1, in 1, starts_with 1., awk, base64, cron, crond
EventType1in 1exec, executed
TargetFilename1wildcard 1/etc/kubernetes/*.conf, /etc/kubernetes/manifests/*, /etc/kubernetes/pki/*
event.category1eq 1process
event.type1ne 1deletion
objectRef.resource1eq 1cronjobs
pod_name1ne 1
process.args1contains 1/etc/kubernetes/manifests/
sourcetype1eq 1cisco:isovalent:processexec
verb1eq 1create

Top indicator values (43 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTypein
exec
1206
EventTypein
executed
198
TargetFilenamewildcard
/etc/kubernetes/*.conf
1
TargetFilenamewildcard
/etc/kubernetes/manifests/*
1
TargetFilenamewildcard
/etc/kubernetes/pki/*
1
event.categoryeq
process
1141
event.typene
deletion
132
objectRef.resourceeq
cronjobs
12
process.argscontains
/etc/kubernetes/manifests/
1
process_nameeq
awk
110
process_nameeq
base64
19
process_nameeq
bash
112
process_nameeq
busybox
112
process_nameeq
cat
17
process_nameeq
cp
19
process_nameeq
curl
129
process_nameeq
dash
19
process_nameeq
dd
110
process_nameeq
echo
1
process_nameeq
mv
14
process_nameeq
nano
1
process_nameeq
node
125
process_nameeq
openssl
128
process_nameeq
scp
15
process_nameeq
sed
14
process_nameeq
sh
112
process_nameeq
tee
14
process_nameeq
touch
16
process_nameeq
vi
1
process_nameeq
vim
1

Exclusions (17 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CurrentDirectorywildcard
/home/*-svc-nessus
1
ParentImagein
/opt/nessus/sbin/nessusd
1
ParentImagein
/opt/nessus_agent/sbin/nessus-agent-module
1
file.extensionin
swp
1
file.extensionin
swx
1
process.argsstarts_with
/etc/kubernetes/manifests/etcd
1
process.argsstarts_with
/etc/kubernetes/manifests/kube-apiserver
1
process.argsstarts_with
/etc/kubernetes/manifests/kube-controller-manager
1
process.argsstarts_with
/etc/kubernetes/manifests/kube-scheduler
1
process.argsstarts_with
printf
1
process_namein
dpkg
1
process_namein
kubeadm
1
process_namein
kubelet
1
process_namein
sed
1
process_namein
vi
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Elastic 2 rules

Splunk 2 rules