huntrule

Azure Activity Logs: Kubernetes CronJob or Job Write Operations

Detects Azure Activity Log write operations for Kubernetes CronJobs and Jobs that can schedule container workloads.

FreeReviewedSigma · Medium · v5
Product
azure
Service
activitylogs
Author
Austin Songer @austinsonger (SigmaHQ), DRL 1.1
Published
2021-11-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Azure Activity Log events where Kubernetes batch-related resource provider operations end with /CRONJOBS/WRITE or /JOBS/WRITE under connected or managed Kubernetes batch providers. These writes indicate changes that can schedule or create finite container executions in the cluster. An attacker can use CronJobs/Jobs to persistently or repeatedly run malicious container workloads using Azure-managed Kubernetes resources. Telemetry relies on Azure Activity Logs operationName values matching the specified prefixes and write suffixes.

Reporting behind it

Related detections9 linkedT1053.003 — drag to rearrange
Suspicious Cron Job Downloading and Executing Payload via GlobalProtect Exploitation
Suspicious Remote Script Download Piped to Shell via 8220 Gang Hadooken
Suspicious Linux Crontab Reboot Persistence to Hidden Sys Cache Binary (via process_creation)
Suspicious Cron Persistence Installing a Downloader via Command Line
Suspicious Cron Persistence File Creation in System Cron Directories (via file_event)
Suspicious Cron Persistence via etc cron.d tsar (via file_event)
Suspicious Cron Job Executing Binary From var tmp via Process Creation
Suspicious Cron Job Persistence Creation on Linux (via process_creation)
Suspicious Cron Persistence File Created in System Cron Directories
Azure Activity Logs: Kubernetes CronJob or Job Write Operations
Pivot detection · T1053.003 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.