Azure Activity Logs: Kubernetes CronJob or Job Write Operations
Detects Azure Activity Log write operations for Kubernetes CronJobs and Jobs that can schedule container workloads.
- Product
- azure
- Service
- activitylogs
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-11-22
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Azure Activity Log events where Kubernetes batch-related resource provider operations end with /CRONJOBS/WRITE or /JOBS/WRITE under connected or managed Kubernetes batch providers. These writes indicate changes that can schedule or create finite container executions in the cluster. An attacker can use CronJobs/Jobs to persistently or repeatedly run malicious container workloads using Azure-managed Kubernetes resources. Telemetry relies on Azure Activity Logs operationName values matching the specified prefixes and write suffixes.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
- kubernetes.iohttps://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
- kubernetes.iohttps://kubernetes.io/docs/concepts/workloads/controllers/job/
- microsoft.comhttps://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Azure Activity Logs: Kubernetes CronJob or Job Write Operations"
id: b2955b10-bfe5-48a8-b009-8e72434e4a63
status: test
description: This rule flags Azure Activity Log events where Kubernetes batch-related resource provider operations end with /CRONJOBS/WRITE or /JOBS/WRITE under connected or managed Kubernetes batch providers. These writes indicate changes that can schedule or create finite container executions in the cluster. An attacker can use CronJobs/Jobs to persistently or repeatedly run malicious container workloads using Azure-managed Kubernetes resources. Telemetry relies on Azure Activity Logs operationName values matching the specified prefixes and write suffixes.
references:
- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
- https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
- https://kubernetes.io/docs/concepts/workloads/controllers/job/
- https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-22
modified: 2022-12-18
tags:
- attack.persistence
- attack.t1053.003
- attack.privilege-escalation
- attack.execution
logsource:
product: azure
service: activitylogs
detection:
selection:
operationName|startswith:
- MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/BATCH
- MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/BATCH
operationName|endswith:
- /CRONJOBS/WRITE
- /JOBS/WRITE
condition: selection
falsepositives:
- Azure Kubernetes CronJob/Job may be done by a system administrator.
- If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: 1c71e254-6655-42c1-b2d6-5e4718d7fc0a
type: derived