Azure Activity Logs: Kubernetes CronJob or Job Write Operations

title: "Azure Activity Logs: Kubernetes CronJob or Job Write Operations"
id: b2955b10-bfe5-48a8-b009-8e72434e4a63
status: test
description: This rule flags Azure Activity Log events where operationName starts with Kubernetes batch job providers and ends with write actions for CronJobs or Jobs. Such writes can be used to schedule or create finite workloads that will run as containers in a Kubernetes cluster. Alerting on these events helps identify unauthorized changes that may enable persistence or execution within the cluster. The rule relies on Azure Activity Logs telemetry matching the relevant operationName patterns.
references:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
  - https://kubernetes.io/docs/concepts/workloads/controllers/job/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-22
modified: 2022-12-18
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.privilege-escalation
  - attack.execution
logsource:
  product: azure
  service: activitylogs
detection:
  selection:
    operationName|startswith:
      - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/BATCH
      - MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/BATCH
    operationName|endswith:
      - /CRONJOBS/WRITE
      - /JOBS/WRITE
  condition: selection
falsepositives:
  - Azure Kubernetes CronJob/Job may be done by a system administrator.
  - If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: 1c71e254-6655-42c1-b2d6-5e4718d7fc0a
    type: derived