detection.wiki

Jobs

OperationDescriptionSampleRule
get-jobsYY
list-jobsYY
watch-jobsYY
create-jobsJob created (cronjob-class persistence or batch execution).YY
update-jobsReplaces an existing Job's spec, the batch-execution primitive a CronJob (or attacker) uses to run a pod once. Sigma's cronjob/job rule covers this verb.YY
patch-jobsModifies an existing Job's spec. Same Sigma cronjob/job-modification rule as update; changing a Job in place is stealthier than creating a new one.YY
delete-jobsRemoves a Job, ending its pod-running task early or clearing evidence of a one-off execution. Same Sigma cronjob/job-modification rule tracks this verb too.YY
deletecollection-jobsYN
get-jobs-statusYN
update-jobs-statusYN
patch-jobs-statusYN
any-jobsSynthetic aggregation for rules that filter the jobs resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.NN

get jobs

#
Resource
jobs

Rule-derived Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
objectRef.resource1 detection ruleElastic
stage1 detection ruleElastic
verb1 detection ruleElastic

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs/dw-harn-jobs",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "name": "dw-harn-jobs",
    "apiGroup": "batch",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:36.164973Z",
  "stageTimestamp": "2026-07-02T04:47:36.166169Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Direct Interactive Kubernetes API Request by Unusual Utilities source low: This rule leverages a combination of Defend for Containers and Kubernetes audit logs to detect the execution of direct interactive Kubernetes API requests via unusual utilities. An adversary may need to execute direct interactive Kubernetes API requests to gain access to the Kubernetes API server or other resources within the cluster. These requests are often used to enumerate the Kubernetes API server or other resources within the cluster, and may indicate an attempt to move laterally within the cluster.T1059, T1059.004, T1069, T1087, T1609, T1610↳ also matches list-jobs: list jobs, watch-jobs: watch jobs, create-jobs: create jobs, update-jobs: update jobs, patch-jobs: patch jobs
    Investigation guide

    Triage and analysis#

    Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

    Investigating Direct Interactive Kubernetes API Request by Unusual Utilities#

    This rule detects interactive commands executed inside containers that use atypical utilities to hit the Kubernetes API, paired with near-simultaneous API activity on pods, secrets, service accounts, roles/bindings, or pod exec/attach/log/portforward. It surfaces hands-on-keyboard discovery and lateral movement using custom scripts that evade common tool allowlists; for example, an intruder opens a shell in a pod, uses Python to query the in-cluster API to list secrets, then triggers pods/exec to pivot into another workload.

    Possible investigation steps#

    • Identify the implicated pod, container image, and executing service account, then quickly review its RBAC bindings and effective permissions to determine blast radius.
    • Inspect the container’s interactive session context by pulling recent command lines, shell history, environment variables, and mounted service account tokens, and look for custom scripts or binaries issuing HTTP requests.
    • Correlate nearby Kubernetes audit entries tied to the same principal and pod to map accessed resources and verbs, noting any exec/attach/portforward or sensitive object interactions across namespaces.
    • Review network activity from the pod to the API server and any in-pod proxies, including DNS lookups and outbound connections, to spot nonstandard clients or tunneling behavior.
    • If suspicious, isolate the pod or node, capture runtime artifacts (e.g., process memory or HTTP client traffic), revoke and rotate the service account credentials, and verify image provenance and integrity.

    False positive analysis#

    • An operator interactively attaches to a pod and uses a Python REPL or bash with /dev/tcp to call the in-cluster API for routine troubleshooting (e.g., list pods, read ConfigMaps, or run selfsubjectaccessreviews), producing normal audit entries that match the rule signature.
    • A correlation artifact arises when two namespaces have pods with the same name: one pod starts an interactive shell while another independently performs get/list/watch calls, and the 1-second sequence keyed only on pod-name links the unrelated events.

    Response and remediation#

    • Immediately isolate the implicated pod that issued direct API calls using a nonstandard utility by applying a deny-all egress NetworkPolicy in its namespace (including to kubernetes.default.svc:443), terminating the interactive session, and scaling its owning Deployment/Job/StatefulSet to zero replicas.
    • Before teardown, capture a runtime snapshot of the container and node including the binary or script used to query the API (e.g., files under /tmp or /dev/tcp usage), shell history, environment, and the mounted service account token and CA bundle at /var/run/secrets/kubernetes.io/serviceaccount/.
    • Revoke access by removing the service account’s RoleBindings/ClusterRoleBindings, deleting all pods that mount that service account to force token rotation, rotating any Secrets and ConfigMaps that were read or created during the window, and deleting any unauthorized Jobs, CronJobs, or Deployments created by the same principal.
    • Restore workloads from a known-good image digest, re-enable the Deployment only after image scan and integrity checks pass, and monitor subsequent Kubernetes audit logs for pods/exec, portforward, and access to secrets across the affected namespaces.
    • Escalate to incident response leadership and consider cluster-wide containment if audit logs show create/patch of ClusterRoleBindings, access to secrets outside the workload’s namespace, or use of pods/exec to pivot into other nodes or system namespaces such as kube-system.
    • Harden access by enforcing least-privilege RBAC that denies pods/exec and attach for application service accounts, setting automountServiceAccountToken: false on workloads that do not need it, restricting egress to the API server with NetworkPolicies, and requiring just-in-time break-glass roles for interactive access.

list jobs

#
Resource
jobs

Rule-derived Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
objectRef.resource1 detection ruleElastic
stage1 detection ruleElastic
verb1 detection ruleElastic

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs?limit=500&timeout=3s",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "apiGroup": "batch",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:36.280480Z",
  "stageTimestamp": "2026-07-02T04:47:36.281856Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Direct Interactive Kubernetes API Request by Unusual Utilities source low: This rule leverages a combination of Defend for Containers and Kubernetes audit logs to detect the execution of direct interactive Kubernetes API requests via unusual utilities. An adversary may need to execute direct interactive Kubernetes API requests to gain access to the Kubernetes API server or other resources within the cluster. These requests are often used to enumerate the Kubernetes API server or other resources within the cluster, and may indicate an attempt to move laterally within the cluster.T1059, T1059.004, T1069, T1087, T1609, T1610↳ also matches get-jobs: get jobs, watch-jobs: watch jobs, create-jobs: create jobs, update-jobs: update jobs, patch-jobs: patch jobs
    Investigation guide

    Triage and analysis#

    Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

    Investigating Direct Interactive Kubernetes API Request by Unusual Utilities#

    This rule detects interactive commands executed inside containers that use atypical utilities to hit the Kubernetes API, paired with near-simultaneous API activity on pods, secrets, service accounts, roles/bindings, or pod exec/attach/log/portforward. It surfaces hands-on-keyboard discovery and lateral movement using custom scripts that evade common tool allowlists; for example, an intruder opens a shell in a pod, uses Python to query the in-cluster API to list secrets, then triggers pods/exec to pivot into another workload.

    Possible investigation steps#

    • Identify the implicated pod, container image, and executing service account, then quickly review its RBAC bindings and effective permissions to determine blast radius.
    • Inspect the container’s interactive session context by pulling recent command lines, shell history, environment variables, and mounted service account tokens, and look for custom scripts or binaries issuing HTTP requests.
    • Correlate nearby Kubernetes audit entries tied to the same principal and pod to map accessed resources and verbs, noting any exec/attach/portforward or sensitive object interactions across namespaces.
    • Review network activity from the pod to the API server and any in-pod proxies, including DNS lookups and outbound connections, to spot nonstandard clients or tunneling behavior.
    • If suspicious, isolate the pod or node, capture runtime artifacts (e.g., process memory or HTTP client traffic), revoke and rotate the service account credentials, and verify image provenance and integrity.

    False positive analysis#

    • An operator interactively attaches to a pod and uses a Python REPL or bash with /dev/tcp to call the in-cluster API for routine troubleshooting (e.g., list pods, read ConfigMaps, or run selfsubjectaccessreviews), producing normal audit entries that match the rule signature.
    • A correlation artifact arises when two namespaces have pods with the same name: one pod starts an interactive shell while another independently performs get/list/watch calls, and the 1-second sequence keyed only on pod-name links the unrelated events.

    Response and remediation#

    • Immediately isolate the implicated pod that issued direct API calls using a nonstandard utility by applying a deny-all egress NetworkPolicy in its namespace (including to kubernetes.default.svc:443), terminating the interactive session, and scaling its owning Deployment/Job/StatefulSet to zero replicas.
    • Before teardown, capture a runtime snapshot of the container and node including the binary or script used to query the API (e.g., files under /tmp or /dev/tcp usage), shell history, environment, and the mounted service account token and CA bundle at /var/run/secrets/kubernetes.io/serviceaccount/.
    • Revoke access by removing the service account’s RoleBindings/ClusterRoleBindings, deleting all pods that mount that service account to force token rotation, rotating any Secrets and ConfigMaps that were read or created during the window, and deleting any unauthorized Jobs, CronJobs, or Deployments created by the same principal.
    • Restore workloads from a known-good image digest, re-enable the Deployment only after image scan and integrity checks pass, and monitor subsequent Kubernetes audit logs for pods/exec, portforward, and access to secrets across the affected namespaces.
    • Escalate to incident response leadership and consider cluster-wide containment if audit logs show create/patch of ClusterRoleBindings, access to secrets outside the workload’s namespace, or use of pods/exec to pivot into other nodes or system namespaces such as kube-system.
    • Harden access by enforcing least-privilege RBAC that denies pods/exec and attach for application service accounts, setting automountServiceAccountToken: false on workloads that do not need it, restricting egress to the API server with NetworkPolicies, and requiring just-in-time break-glass roles for interactive access.

watch jobs

#
Resource
jobs

Rule-derived Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
objectRef.resource1 detection ruleElastic
stage1 detection ruleElastic
verb1 detection ruleElastic

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs?resourceVersion=1567&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "apiGroup": "batch",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:36.282975Z",
  "stageTimestamp": "2026-07-02T04:47:39.286146Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Direct Interactive Kubernetes API Request by Unusual Utilities source low: This rule leverages a combination of Defend for Containers and Kubernetes audit logs to detect the execution of direct interactive Kubernetes API requests via unusual utilities. An adversary may need to execute direct interactive Kubernetes API requests to gain access to the Kubernetes API server or other resources within the cluster. These requests are often used to enumerate the Kubernetes API server or other resources within the cluster, and may indicate an attempt to move laterally within the cluster.T1059, T1059.004, T1069, T1087, T1609, T1610↳ also matches get-jobs: get jobs, list-jobs: list jobs, create-jobs: create jobs, update-jobs: update jobs, patch-jobs: patch jobs
    Investigation guide

    Triage and analysis#

    Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

    Investigating Direct Interactive Kubernetes API Request by Unusual Utilities#

    This rule detects interactive commands executed inside containers that use atypical utilities to hit the Kubernetes API, paired with near-simultaneous API activity on pods, secrets, service accounts, roles/bindings, or pod exec/attach/log/portforward. It surfaces hands-on-keyboard discovery and lateral movement using custom scripts that evade common tool allowlists; for example, an intruder opens a shell in a pod, uses Python to query the in-cluster API to list secrets, then triggers pods/exec to pivot into another workload.

    Possible investigation steps#

    • Identify the implicated pod, container image, and executing service account, then quickly review its RBAC bindings and effective permissions to determine blast radius.
    • Inspect the container’s interactive session context by pulling recent command lines, shell history, environment variables, and mounted service account tokens, and look for custom scripts or binaries issuing HTTP requests.
    • Correlate nearby Kubernetes audit entries tied to the same principal and pod to map accessed resources and verbs, noting any exec/attach/portforward or sensitive object interactions across namespaces.
    • Review network activity from the pod to the API server and any in-pod proxies, including DNS lookups and outbound connections, to spot nonstandard clients or tunneling behavior.
    • If suspicious, isolate the pod or node, capture runtime artifacts (e.g., process memory or HTTP client traffic), revoke and rotate the service account credentials, and verify image provenance and integrity.

    False positive analysis#

    • An operator interactively attaches to a pod and uses a Python REPL or bash with /dev/tcp to call the in-cluster API for routine troubleshooting (e.g., list pods, read ConfigMaps, or run selfsubjectaccessreviews), producing normal audit entries that match the rule signature.
    • A correlation artifact arises when two namespaces have pods with the same name: one pod starts an interactive shell while another independently performs get/list/watch calls, and the 1-second sequence keyed only on pod-name links the unrelated events.

    Response and remediation#

    • Immediately isolate the implicated pod that issued direct API calls using a nonstandard utility by applying a deny-all egress NetworkPolicy in its namespace (including to kubernetes.default.svc:443), terminating the interactive session, and scaling its owning Deployment/Job/StatefulSet to zero replicas.
    • Before teardown, capture a runtime snapshot of the container and node including the binary or script used to query the API (e.g., files under /tmp or /dev/tcp usage), shell history, environment, and the mounted service account token and CA bundle at /var/run/secrets/kubernetes.io/serviceaccount/.
    • Revoke access by removing the service account’s RoleBindings/ClusterRoleBindings, deleting all pods that mount that service account to force token rotation, rotating any Secrets and ConfigMaps that were read or created during the window, and deleting any unauthorized Jobs, CronJobs, or Deployments created by the same principal.
    • Restore workloads from a known-good image digest, re-enable the Deployment only after image scan and integrity checks pass, and monitor subsequent Kubernetes audit logs for pods/exec, portforward, and access to secrets across the affected namespaces.
    • Escalate to incident response leadership and consider cluster-wide containment if audit logs show create/patch of ClusterRoleBindings, access to secrets outside the workload’s namespace, or use of pods/exec to pivot into other nodes or system namespaces such as kube-system.
    • Harden access by enforcing least-privilege RBAC that denies pods/exec and attach for application service accounts, setting automountServiceAccountToken: false on workloads that do not need it, restricting egress to the API server with NetworkPolicies, and requiring just-in-time break-glass roles for interactive access.

create jobs

#
Resource
jobs

Description

Job created (cronjob-class persistence or batch execution).

Rule-derived Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
objectRef.resource2 detection rulesElastic, Sigma
verb2 detection rulesElastic, Sigma
objectRef.apiGroup1 detection ruleSigma
stage1 detection ruleElastic

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "582c31ab-4906-49bb-9ff9-872f980ccb84",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/test2/jobs?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "k8s-test-user",
    "uid": "aws-iam-authenticator:591511147606:AROAYTOGP2RLFHNBOTP5J",
    "groups": [
      "system:authenticated"
    ]
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.27.2 (darwin/arm64) kubernetes/7f6f68f",
  "objectRef": {
    "resource": "jobs",
    "namespace": "test2",
    "apiGroup": "batch",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Failure",
    "message": "jobs.batch is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group \"batch\" in the namespace \"test2\"",
    "reason": "Forbidden",
    "details": {
      "group": "batch",
      "kind": "jobs"
    },
    "code": 403
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Failure",
    "message": "jobs.batch is forbidden: User \"k8s-test-user\" cannot create resource \"jobs\" in API group \"batch\" in the namespace \"test2\"",
    "reason": "Forbidden",
    "details": {
      "group": "batch",
      "kind": "jobs"
    },
    "code": 403
  },
  "requestReceivedTimestamp": "2023-12-07T14:44:53.358394Z",
  "stageTimestamp": "2023-12-07T14:44:53.375985Z",
  "annotations": {
    "authorization.k8s.io/decision": "forbid",
    "authorization.k8s.io/reason": ""
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
objectRef.resource (sigma rule field)eqcronjobs1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • Direct Interactive Kubernetes API Request by Unusual Utilities source low: This rule leverages a combination of Defend for Containers and Kubernetes audit logs to detect the execution of direct interactive Kubernetes API requests via unusual utilities. An adversary may need to execute direct interactive Kubernetes API requests to gain access to the Kubernetes API server or other resources within the cluster. These requests are often used to enumerate the Kubernetes API server or other resources within the cluster, and may indicate an attempt to move laterally within the cluster.T1059, T1059.004, T1069, T1087, T1609, T1610↳ also matches get-jobs: get jobs, list-jobs: list jobs, watch-jobs: watch jobs, update-jobs: update jobs, patch-jobs: patch jobs
    Investigation guide

    Triage and analysis#

    Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

    Investigating Direct Interactive Kubernetes API Request by Unusual Utilities#

    This rule detects interactive commands executed inside containers that use atypical utilities to hit the Kubernetes API, paired with near-simultaneous API activity on pods, secrets, service accounts, roles/bindings, or pod exec/attach/log/portforward. It surfaces hands-on-keyboard discovery and lateral movement using custom scripts that evade common tool allowlists; for example, an intruder opens a shell in a pod, uses Python to query the in-cluster API to list secrets, then triggers pods/exec to pivot into another workload.

    Possible investigation steps#

    • Identify the implicated pod, container image, and executing service account, then quickly review its RBAC bindings and effective permissions to determine blast radius.
    • Inspect the container’s interactive session context by pulling recent command lines, shell history, environment variables, and mounted service account tokens, and look for custom scripts or binaries issuing HTTP requests.
    • Correlate nearby Kubernetes audit entries tied to the same principal and pod to map accessed resources and verbs, noting any exec/attach/portforward or sensitive object interactions across namespaces.
    • Review network activity from the pod to the API server and any in-pod proxies, including DNS lookups and outbound connections, to spot nonstandard clients or tunneling behavior.
    • If suspicious, isolate the pod or node, capture runtime artifacts (e.g., process memory or HTTP client traffic), revoke and rotate the service account credentials, and verify image provenance and integrity.

    False positive analysis#

    • An operator interactively attaches to a pod and uses a Python REPL or bash with /dev/tcp to call the in-cluster API for routine troubleshooting (e.g., list pods, read ConfigMaps, or run selfsubjectaccessreviews), producing normal audit entries that match the rule signature.
    • A correlation artifact arises when two namespaces have pods with the same name: one pod starts an interactive shell while another independently performs get/list/watch calls, and the 1-second sequence keyed only on pod-name links the unrelated events.

    Response and remediation#

    • Immediately isolate the implicated pod that issued direct API calls using a nonstandard utility by applying a deny-all egress NetworkPolicy in its namespace (including to kubernetes.default.svc:443), terminating the interactive session, and scaling its owning Deployment/Job/StatefulSet to zero replicas.
    • Before teardown, capture a runtime snapshot of the container and node including the binary or script used to query the API (e.g., files under /tmp or /dev/tcp usage), shell history, environment, and the mounted service account token and CA bundle at /var/run/secrets/kubernetes.io/serviceaccount/.
    • Revoke access by removing the service account’s RoleBindings/ClusterRoleBindings, deleting all pods that mount that service account to force token rotation, rotating any Secrets and ConfigMaps that were read or created during the window, and deleting any unauthorized Jobs, CronJobs, or Deployments created by the same principal.
    • Restore workloads from a known-good image digest, re-enable the Deployment only after image scan and integrity checks pass, and monitor subsequent Kubernetes audit logs for pods/exec, portforward, and access to secrets across the affected namespaces.
    • Escalate to incident response leadership and consider cluster-wide containment if audit logs show create/patch of ClusterRoleBindings, access to secrets outside the workload’s namespace, or use of pods/exec to pivot into other nodes or system namespaces such as kube-system.
    • Harden access by enforcing least-privilege RBAC that denies pods/exec and attach for application service accounts, setting automountServiceAccountToken: false on workloads that do not need it, restricting egress to the API server with NetworkPolicies, and requiring just-in-time break-glass roles for interactive access.

References #

update jobs

#
Resource
jobs

Description

Replaces an existing Job's spec, the batch-execution primitive a CronJob (or attacker) uses to run a pod once. Sigma's cronjob/job rule covers this verb.

Rule-derived Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
objectRef.resource2 detection rulesElastic, Sigma
verb2 detection rulesElastic, Sigma
objectRef.apiGroup1 detection ruleSigma
stage1 detection ruleElastic

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs/dw-harn-jobs?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "name": "dw-harn-jobs",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "batch",
    "apiVersion": "v1",
    "resourceVersion": "736"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "Job",
    "apiVersion": "batch/v1",
    "metadata": {
      "name": "dw-harn-jobs",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "736",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:31:02Z",
      "labels": {
        "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
        "batch.kubernetes.io/job-name": "dw-harn-jobs",
        "controller-uid": "00000000-0000-0000-0000-000000000000",
        "dw-harn-patched": "1",
        "job-name": "dw-harn-jobs"
      }
    },
    "spec": {
      "parallelism": 1,
      "completions": 1,
      "backoffLimit": 0,
      "selector": {
        "matchLabels": {
          "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000"
        }
      },
      "manualSelector": false,
      "template": {
        "metadata": {
          "labels": {
            "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
            "batch.kubernetes.io/job-name": "dw-harn-jobs",
            "controller-uid": "00000000-0000-0000-0000-000000000000",
            "job-name": "dw-harn-jobs"
          }
        },
        "spec": {
          "containers": [
            {
              "name": "c",
              "image": "docker.io/library/busybox:1.36",
              "command": [
                "true"
              ],
              "resources": {},
              "terminationMessagePath": "/dev/termination-log",
              "terminationMessagePolicy": "File",
              "imagePullPolicy": "IfNotPresent"
            }
          ],
          "restartPolicy": "Never",
          "terminationGracePeriodSeconds": 30,
          "dnsPolicy": "ClusterFirst",
          "securityContext": {},
          "schedulerName": "default-scheduler"
        }
      },
      "completionMode": "NonIndexed",
      "suspend": false,
      "podReplacementPolicy": "TerminatingOrFailed"
    },
    "status": {
      "conditions": [
        {
          "type": "SuccessCriteriaMet",
          "status": "True",
          "lastProbeTime": "2026-07-02T21:31:05Z",
          "lastTransitionTime": "2026-07-02T21:31:05Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        },
        {
          "type": "Complete",
          "status": "True",
          "lastProbeTime": "2026-07-02T21:31:05Z",
          "lastTransitionTime": "2026-07-02T21:31:05Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        }
      ],
      "startTime": "2026-07-02T21:31:02Z",
      "completionTime": "2026-07-02T21:31:05Z",
      "succeeded": 1,
      "terminating": 0,
      "uncountedTerminatedPods": {},
      "ready": 0
    }
  },
  "responseObject": {
    "kind": "Job",
    "apiVersion": "batch/v1",
    "metadata": {
      "name": "dw-harn-jobs",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "736",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:31:02Z",
      "labels": {
        "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
        "batch.kubernetes.io/job-name": "dw-harn-jobs",
        "controller-uid": "00000000-0000-0000-0000-000000000000",
        "dw-harn-patched": "1",
        "job-name": "dw-harn-jobs"
      }
    },
    "spec": {
      "parallelism": 1,
      "completions": 1,
      "backoffLimit": 0,
      "selector": {
        "matchLabels": {
          "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000"
        }
      },
      "manualSelector": false,
      "template": {
        "metadata": {
          "labels": {
            "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
            "batch.kubernetes.io/job-name": "dw-harn-jobs",
            "controller-uid": "00000000-0000-0000-0000-000000000000",
            "job-name": "dw-harn-jobs"
          }
        },
        "spec": {
          "containers": [
            {
              "name": "c",
              "image": "docker.io/library/busybox:1.36",
              "command": [
                "true"
              ],
              "resources": {},
              "terminationMessagePath": "/dev/termination-log",
              "terminationMessagePolicy": "File",
              "imagePullPolicy": "IfNotPresent"
            }
          ],
          "restartPolicy": "Never",
          "terminationGracePeriodSeconds": 30,
          "dnsPolicy": "ClusterFirst",
          "securityContext": {},
          "schedulerName": "default-scheduler"
        }
      },
      "completionMode": "NonIndexed",
      "suspend": false,
      "podReplacementPolicy": "TerminatingOrFailed"
    },
    "status": {
      "conditions": [
        {
          "type": "SuccessCriteriaMet",
          "status": "True",
          "lastProbeTime": "2026-07-02T21:31:05Z",
          "lastTransitionTime": "2026-07-02T21:31:05Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        },
        {
          "type": "Complete",
          "status": "True",
          "lastProbeTime": "2026-07-02T21:31:05Z",
          "lastTransitionTime": "2026-07-02T21:31:05Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        }
      ],
      "startTime": "2026-07-02T21:31:02Z",
      "completionTime": "2026-07-02T21:31:05Z",
      "succeeded": 1,
      "terminating": 0,
      "uncountedTerminatedPods": {},
      "ready": 0
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:31:05.870084Z",
  "stageTimestamp": "2026-07-02T21:31:05.873754Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
objectRef.resource (sigma rule field)eqcronjobs1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • Direct Interactive Kubernetes API Request by Unusual Utilities source low: This rule leverages a combination of Defend for Containers and Kubernetes audit logs to detect the execution of direct interactive Kubernetes API requests via unusual utilities. An adversary may need to execute direct interactive Kubernetes API requests to gain access to the Kubernetes API server or other resources within the cluster. These requests are often used to enumerate the Kubernetes API server or other resources within the cluster, and may indicate an attempt to move laterally within the cluster.T1059, T1059.004, T1069, T1087, T1609, T1610↳ also matches get-jobs: get jobs, list-jobs: list jobs, watch-jobs: watch jobs, create-jobs: create jobs, patch-jobs: patch jobs
    Investigation guide

    Triage and analysis#

    Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

    Investigating Direct Interactive Kubernetes API Request by Unusual Utilities#

    This rule detects interactive commands executed inside containers that use atypical utilities to hit the Kubernetes API, paired with near-simultaneous API activity on pods, secrets, service accounts, roles/bindings, or pod exec/attach/log/portforward. It surfaces hands-on-keyboard discovery and lateral movement using custom scripts that evade common tool allowlists; for example, an intruder opens a shell in a pod, uses Python to query the in-cluster API to list secrets, then triggers pods/exec to pivot into another workload.

    Possible investigation steps#

    • Identify the implicated pod, container image, and executing service account, then quickly review its RBAC bindings and effective permissions to determine blast radius.
    • Inspect the container’s interactive session context by pulling recent command lines, shell history, environment variables, and mounted service account tokens, and look for custom scripts or binaries issuing HTTP requests.
    • Correlate nearby Kubernetes audit entries tied to the same principal and pod to map accessed resources and verbs, noting any exec/attach/portforward or sensitive object interactions across namespaces.
    • Review network activity from the pod to the API server and any in-pod proxies, including DNS lookups and outbound connections, to spot nonstandard clients or tunneling behavior.
    • If suspicious, isolate the pod or node, capture runtime artifacts (e.g., process memory or HTTP client traffic), revoke and rotate the service account credentials, and verify image provenance and integrity.

    False positive analysis#

    • An operator interactively attaches to a pod and uses a Python REPL or bash with /dev/tcp to call the in-cluster API for routine troubleshooting (e.g., list pods, read ConfigMaps, or run selfsubjectaccessreviews), producing normal audit entries that match the rule signature.
    • A correlation artifact arises when two namespaces have pods with the same name: one pod starts an interactive shell while another independently performs get/list/watch calls, and the 1-second sequence keyed only on pod-name links the unrelated events.

    Response and remediation#

    • Immediately isolate the implicated pod that issued direct API calls using a nonstandard utility by applying a deny-all egress NetworkPolicy in its namespace (including to kubernetes.default.svc:443), terminating the interactive session, and scaling its owning Deployment/Job/StatefulSet to zero replicas.
    • Before teardown, capture a runtime snapshot of the container and node including the binary or script used to query the API (e.g., files under /tmp or /dev/tcp usage), shell history, environment, and the mounted service account token and CA bundle at /var/run/secrets/kubernetes.io/serviceaccount/.
    • Revoke access by removing the service account’s RoleBindings/ClusterRoleBindings, deleting all pods that mount that service account to force token rotation, rotating any Secrets and ConfigMaps that were read or created during the window, and deleting any unauthorized Jobs, CronJobs, or Deployments created by the same principal.
    • Restore workloads from a known-good image digest, re-enable the Deployment only after image scan and integrity checks pass, and monitor subsequent Kubernetes audit logs for pods/exec, portforward, and access to secrets across the affected namespaces.
    • Escalate to incident response leadership and consider cluster-wide containment if audit logs show create/patch of ClusterRoleBindings, access to secrets outside the workload’s namespace, or use of pods/exec to pivot into other nodes or system namespaces such as kube-system.
    • Harden access by enforcing least-privilege RBAC that denies pods/exec and attach for application service accounts, setting automountServiceAccountToken: false on workloads that do not need it, restricting egress to the API server with NetworkPolicies, and requiring just-in-time break-glass roles for interactive access.

patch jobs

#
Resource
jobs

Description

Modifies an existing Job's spec. Same Sigma cronjob/job-modification rule as update; changing a Job in place is stealthier than creating a new one.

Rule-derived Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
objectRef.resource2 detection rulesElastic, Sigma
verb2 detection rulesElastic, Sigma
objectRef.apiGroup1 detection ruleSigma
stage1 detection ruleElastic

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs/dw-harn-jobs?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "name": "dw-harn-jobs",
    "apiGroup": "batch",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "Job",
    "apiVersion": "batch/v1",
    "metadata": {
      "name": "dw-harn-jobs",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1580",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:47:36Z",
      "labels": {
        "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
        "batch.kubernetes.io/job-name": "dw-harn-jobs",
        "controller-uid": "00000000-0000-0000-0000-000000000000",
        "dw-harn-patched": "1",
        "job-name": "dw-harn-jobs"
      }
    },
    "spec": {
      "parallelism": 1,
      "completions": 1,
      "backoffLimit": 0,
      "selector": {
        "matchLabels": {
          "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000"
        }
      },
      "manualSelector": false,
      "template": {
        "metadata": {
          "labels": {
            "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
            "batch.kubernetes.io/job-name": "dw-harn-jobs",
            "controller-uid": "00000000-0000-0000-0000-000000000000",
            "job-name": "dw-harn-jobs"
          }
        },
        "spec": {
          "containers": [
            {
              "name": "c",
              "image": "docker.io/library/busybox:1.36",
              "command": [
                "true"
              ],
              "resources": {},
              "terminationMessagePath": "/dev/termination-log",
              "terminationMessagePolicy": "File",
              "imagePullPolicy": "IfNotPresent"
            }
          ],
          "restartPolicy": "Never",
          "terminationGracePeriodSeconds": 30,
          "dnsPolicy": "ClusterFirst",
          "securityContext": {},
          "schedulerName": "default-scheduler"
        }
      },
      "completionMode": "NonIndexed",
      "suspend": false,
      "podReplacementPolicy": "TerminatingOrFailed"
    },
    "status": {
      "startTime": "2026-07-02T04:47:36Z",
      "active": 1,
      "terminating": 0,
      "uncountedTerminatedPods": {},
      "ready": 0
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:39.352748Z",
  "stageTimestamp": "2026-07-02T04:47:39.358201Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
objectRef.resource (sigma rule field)eqcronjobs1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Elastic #

  • Direct Interactive Kubernetes API Request by Unusual Utilities source low: This rule leverages a combination of Defend for Containers and Kubernetes audit logs to detect the execution of direct interactive Kubernetes API requests via unusual utilities. An adversary may need to execute direct interactive Kubernetes API requests to gain access to the Kubernetes API server or other resources within the cluster. These requests are often used to enumerate the Kubernetes API server or other resources within the cluster, and may indicate an attempt to move laterally within the cluster.T1059, T1059.004, T1069, T1087, T1609, T1610↳ also matches get-jobs: get jobs, list-jobs: list jobs, watch-jobs: watch jobs, create-jobs: create jobs, update-jobs: update jobs
    Investigation guide

    Triage and analysis#

    Disclaimer: This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.

    Investigating Direct Interactive Kubernetes API Request by Unusual Utilities#

    This rule detects interactive commands executed inside containers that use atypical utilities to hit the Kubernetes API, paired with near-simultaneous API activity on pods, secrets, service accounts, roles/bindings, or pod exec/attach/log/portforward. It surfaces hands-on-keyboard discovery and lateral movement using custom scripts that evade common tool allowlists; for example, an intruder opens a shell in a pod, uses Python to query the in-cluster API to list secrets, then triggers pods/exec to pivot into another workload.

    Possible investigation steps#

    • Identify the implicated pod, container image, and executing service account, then quickly review its RBAC bindings and effective permissions to determine blast radius.
    • Inspect the container’s interactive session context by pulling recent command lines, shell history, environment variables, and mounted service account tokens, and look for custom scripts or binaries issuing HTTP requests.
    • Correlate nearby Kubernetes audit entries tied to the same principal and pod to map accessed resources and verbs, noting any exec/attach/portforward or sensitive object interactions across namespaces.
    • Review network activity from the pod to the API server and any in-pod proxies, including DNS lookups and outbound connections, to spot nonstandard clients or tunneling behavior.
    • If suspicious, isolate the pod or node, capture runtime artifacts (e.g., process memory or HTTP client traffic), revoke and rotate the service account credentials, and verify image provenance and integrity.

    False positive analysis#

    • An operator interactively attaches to a pod and uses a Python REPL or bash with /dev/tcp to call the in-cluster API for routine troubleshooting (e.g., list pods, read ConfigMaps, or run selfsubjectaccessreviews), producing normal audit entries that match the rule signature.
    • A correlation artifact arises when two namespaces have pods with the same name: one pod starts an interactive shell while another independently performs get/list/watch calls, and the 1-second sequence keyed only on pod-name links the unrelated events.

    Response and remediation#

    • Immediately isolate the implicated pod that issued direct API calls using a nonstandard utility by applying a deny-all egress NetworkPolicy in its namespace (including to kubernetes.default.svc:443), terminating the interactive session, and scaling its owning Deployment/Job/StatefulSet to zero replicas.
    • Before teardown, capture a runtime snapshot of the container and node including the binary or script used to query the API (e.g., files under /tmp or /dev/tcp usage), shell history, environment, and the mounted service account token and CA bundle at /var/run/secrets/kubernetes.io/serviceaccount/.
    • Revoke access by removing the service account’s RoleBindings/ClusterRoleBindings, deleting all pods that mount that service account to force token rotation, rotating any Secrets and ConfigMaps that were read or created during the window, and deleting any unauthorized Jobs, CronJobs, or Deployments created by the same principal.
    • Restore workloads from a known-good image digest, re-enable the Deployment only after image scan and integrity checks pass, and monitor subsequent Kubernetes audit logs for pods/exec, portforward, and access to secrets across the affected namespaces.
    • Escalate to incident response leadership and consider cluster-wide containment if audit logs show create/patch of ClusterRoleBindings, access to secrets outside the workload’s namespace, or use of pods/exec to pivot into other nodes or system namespaces such as kube-system.
    • Harden access by enforcing least-privilege RBAC that denies pods/exec and attach for application service accounts, setting automountServiceAccountToken: false on workloads that do not need it, restricting egress to the API server with NetworkPolicies, and requiring just-in-time break-glass roles for interactive access.

delete jobs

#
Resource
jobs

Description

Removes a Job, ending its pod-running task early or clearing evidence of a one-off execution. Same Sigma cronjob/job-modification rule tracks this verb too.

Rule-derived Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

NameRulesVendors
objectRef.apiGroup1 detection ruleSigma
objectRef.resource1 detection ruleSigma
verb1 detection ruleSigma

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs/dw-harn-jobs",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "name": "dw-harn-jobs",
    "apiGroup": "batch",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-jobs",
      "group": "batch",
      "kind": "jobs",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-jobs",
      "group": "batch",
      "kind": "jobs",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:47:39.419131Z",
  "stageTimestamp": "2026-07-02T04:47:39.422108Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

FieldKindValueRulesVendors
objectRef.resource (sigma rule field)eqcronjobs1 rulesigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

deletecollection jobs

#
Resource
jobs

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "apiGroup": "batch",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "JobList",
    "apiVersion": "batch/v1",
    "metadata": {
      "resourceVersion": "866"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-jobs",
          "namespace": "dw-harn",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "865",
          "generation": 1,
          "creationTimestamp": "2026-07-02T23:13:04Z",
          "labels": {
            "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
            "batch.kubernetes.io/job-name": "dw-harn-jobs",
            "controller-uid": "00000000-0000-0000-0000-000000000000",
            "dw-harn-patched": "1",
            "job-name": "dw-harn-jobs"
          }
        },
        "spec": {
          "parallelism": 1,
          "completions": 1,
          "backoffLimit": 0,
          "selector": {
            "matchLabels": {
              "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000"
            }
          },
          "manualSelector": false,
          "template": {
            "metadata": {
              "labels": {
                "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
                "batch.kubernetes.io/job-name": "dw-harn-jobs",
                "controller-uid": "00000000-0000-0000-0000-000000000000",
                "job-name": "dw-harn-jobs"
              }
            },
            "spec": {
              "containers": [
                {
                  "name": "c",
                  "image": "docker.io/library/busybox:1.36",
                  "command": [
                    "true"
                  ],
                  "resources": {},
                  "terminationMessagePath": "/dev/termination-log",
                  "terminationMessagePolicy": "File",
                  "imagePullPolicy": "IfNotPresent"
                }
              ],
              "restartPolicy": "Never",
              "terminationGracePeriodSeconds": 30,
              "dnsPolicy": "ClusterFirst",
              "securityContext": {},
              "schedulerName": "default-scheduler"
            }
          },
          "completionMode": "NonIndexed",
          "suspend": false,
          "podReplacementPolicy": "TerminatingOrFailed"
        },
        "status": {
          "conditions": [
            {
              "type": "SuccessCriteriaMet",
              "status": "True",
              "lastProbeTime": "2026-07-02T23:13:07Z",
              "lastTransitionTime": "2026-07-02T23:13:07Z",
              "reason": "CompletionsReached",
              "message": "Reached expected number of succeeded pods"
            },
            {
              "type": "Complete",
              "status": "True",
              "lastProbeTime": "2026-07-02T23:13:07Z",
              "lastTransitionTime": "2026-07-02T23:13:07Z",
              "reason": "CompletionsReached",
              "message": "Reached expected number of succeeded pods"
            }
          ],
          "startTime": "2026-07-02T23:13:04Z",
          "completionTime": "2026-07-02T23:13:07Z",
          "succeeded": 1,
          "terminating": 0,
          "uncountedTerminatedPods": {},
          "ready": 0
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:13:08.498723Z",
  "stageTimestamp": "2026-07-02T23:13:08.505044Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

get jobs/status

#
Resource
jobs

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs/dw-harn-jobs/status",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "name": "dw-harn-jobs",
    "apiGroup": "batch",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T21:31:05.940246Z",
  "stageTimestamp": "2026-07-02T21:31:05.942013Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

update jobs/status

#
Resource
jobs

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs/dw-harn-jobs/status?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "name": "dw-harn-jobs",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "batch",
    "apiVersion": "v1",
    "resourceVersion": "736",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "Job",
    "apiVersion": "batch/v1",
    "metadata": {
      "name": "dw-harn-jobs",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "736",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:31:02Z",
      "labels": {
        "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
        "batch.kubernetes.io/job-name": "dw-harn-jobs",
        "controller-uid": "00000000-0000-0000-0000-000000000000",
        "dw-harn-patched": "1",
        "job-name": "dw-harn-jobs"
      }
    },
    "spec": {
      "parallelism": 1,
      "completions": 1,
      "backoffLimit": 0,
      "selector": {
        "matchLabels": {
          "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000"
        }
      },
      "manualSelector": false,
      "template": {
        "metadata": {
          "labels": {
            "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
            "batch.kubernetes.io/job-name": "dw-harn-jobs",
            "controller-uid": "00000000-0000-0000-0000-000000000000",
            "job-name": "dw-harn-jobs"
          }
        },
        "spec": {
          "containers": [
            {
              "name": "c",
              "image": "docker.io/library/busybox:1.36",
              "command": [
                "true"
              ],
              "resources": {},
              "terminationMessagePath": "/dev/termination-log",
              "terminationMessagePolicy": "File",
              "imagePullPolicy": "IfNotPresent"
            }
          ],
          "restartPolicy": "Never",
          "terminationGracePeriodSeconds": 30,
          "dnsPolicy": "ClusterFirst",
          "securityContext": {},
          "schedulerName": "default-scheduler"
        }
      },
      "completionMode": "NonIndexed",
      "suspend": false,
      "podReplacementPolicy": "TerminatingOrFailed"
    },
    "status": {
      "conditions": [
        {
          "type": "SuccessCriteriaMet",
          "status": "True",
          "lastProbeTime": "2026-07-02T21:31:05Z",
          "lastTransitionTime": "2026-07-02T21:31:05Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        },
        {
          "type": "Complete",
          "status": "True",
          "lastProbeTime": "2026-07-02T21:31:05Z",
          "lastTransitionTime": "2026-07-02T21:31:05Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        }
      ],
      "startTime": "2026-07-02T21:31:02Z",
      "completionTime": "2026-07-02T21:31:05Z",
      "succeeded": 1,
      "terminating": 0,
      "uncountedTerminatedPods": {},
      "ready": 0
    }
  },
  "responseObject": {
    "kind": "Job",
    "apiVersion": "batch/v1",
    "metadata": {
      "name": "dw-harn-jobs",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "736",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:31:02Z",
      "labels": {
        "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
        "batch.kubernetes.io/job-name": "dw-harn-jobs",
        "controller-uid": "00000000-0000-0000-0000-000000000000",
        "dw-harn-patched": "1",
        "job-name": "dw-harn-jobs"
      }
    },
    "spec": {
      "parallelism": 1,
      "completions": 1,
      "backoffLimit": 0,
      "selector": {
        "matchLabels": {
          "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000"
        }
      },
      "manualSelector": false,
      "template": {
        "metadata": {
          "labels": {
            "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
            "batch.kubernetes.io/job-name": "dw-harn-jobs",
            "controller-uid": "00000000-0000-0000-0000-000000000000",
            "job-name": "dw-harn-jobs"
          }
        },
        "spec": {
          "containers": [
            {
              "name": "c",
              "image": "docker.io/library/busybox:1.36",
              "command": [
                "true"
              ],
              "resources": {},
              "terminationMessagePath": "/dev/termination-log",
              "terminationMessagePolicy": "File",
              "imagePullPolicy": "IfNotPresent"
            }
          ],
          "restartPolicy": "Never",
          "terminationGracePeriodSeconds": 30,
          "dnsPolicy": "ClusterFirst",
          "securityContext": {},
          "schedulerName": "default-scheduler"
        }
      },
      "completionMode": "NonIndexed",
      "suspend": false,
      "podReplacementPolicy": "TerminatingOrFailed"
    },
    "status": {
      "conditions": [
        {
          "type": "SuccessCriteriaMet",
          "status": "True",
          "lastProbeTime": "2026-07-02T21:31:05Z",
          "lastTransitionTime": "2026-07-02T21:31:05Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        },
        {
          "type": "Complete",
          "status": "True",
          "lastProbeTime": "2026-07-02T21:31:05Z",
          "lastTransitionTime": "2026-07-02T21:31:05Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        }
      ],
      "startTime": "2026-07-02T21:31:02Z",
      "completionTime": "2026-07-02T21:31:05Z",
      "succeeded": 1,
      "terminating": 0,
      "uncountedTerminatedPods": {},
      "ready": 0
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:31:06.023662Z",
  "stageTimestamp": "2026-07-02T21:31:06.027038Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

patch jobs/status

#
Resource
jobs

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/batch/v1/namespaces/dw-harn/jobs/dw-harn-jobs/status?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=786fc563dbb253683c44d23d0aac3742ea61ade7f27a43f50934a82662e15409"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "jobs",
    "namespace": "dw-harn",
    "name": "dw-harn-jobs",
    "apiGroup": "batch",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {},
  "responseObject": {
    "kind": "Job",
    "apiVersion": "batch/v1",
    "metadata": {
      "name": "dw-harn-jobs",
      "namespace": "dw-harn",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "777",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:17:44Z",
      "labels": {
        "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
        "batch.kubernetes.io/job-name": "dw-harn-jobs",
        "controller-uid": "00000000-0000-0000-0000-000000000000",
        "dw-harn-patched": "1",
        "job-name": "dw-harn-jobs"
      }
    },
    "spec": {
      "parallelism": 1,
      "completions": 1,
      "backoffLimit": 0,
      "selector": {
        "matchLabels": {
          "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000"
        }
      },
      "manualSelector": false,
      "template": {
        "metadata": {
          "labels": {
            "batch.kubernetes.io/controller-uid": "00000000-0000-0000-0000-000000000000",
            "batch.kubernetes.io/job-name": "dw-harn-jobs",
            "controller-uid": "00000000-0000-0000-0000-000000000000",
            "job-name": "dw-harn-jobs"
          }
        },
        "spec": {
          "containers": [
            {
              "name": "c",
              "image": "docker.io/library/busybox:1.36",
              "command": [
                "true"
              ],
              "resources": {},
              "terminationMessagePath": "/dev/termination-log",
              "terminationMessagePolicy": "File",
              "imagePullPolicy": "IfNotPresent"
            }
          ],
          "restartPolicy": "Never",
          "terminationGracePeriodSeconds": 30,
          "dnsPolicy": "ClusterFirst",
          "securityContext": {},
          "schedulerName": "default-scheduler"
        }
      },
      "completionMode": "NonIndexed",
      "suspend": false,
      "podReplacementPolicy": "TerminatingOrFailed"
    },
    "status": {
      "conditions": [
        {
          "type": "SuccessCriteriaMet",
          "status": "True",
          "lastProbeTime": "2026-07-02T22:17:48Z",
          "lastTransitionTime": "2026-07-02T22:17:48Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        },
        {
          "type": "Complete",
          "status": "True",
          "lastProbeTime": "2026-07-02T22:17:48Z",
          "lastTransitionTime": "2026-07-02T22:17:48Z",
          "reason": "CompletionsReached",
          "message": "Reached expected number of succeeded pods"
        }
      ],
      "startTime": "2026-07-02T22:17:45Z",
      "completionTime": "2026-07-02T22:17:48Z",
      "succeeded": 1,
      "terminating": 0,
      "uncountedTerminatedPods": {},
      "ready": 0
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:17:48.759079Z",
  "stageTimestamp": "2026-07-02T22:17:48.762126Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

any verb on jobs (synthetic aggregation)

#
Resource
jobs

Description

Synthetic aggregation for rules that filter the jobs resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.