GCP Audit Detects Kubernetes CronJob and Job Creation Requests

title: GCP Audit Detects Kubernetes CronJob and Job Creation Requests
id: 71b786c1-13ea-42a7-9103-de147627a891
status: test
description: This rule identifies Google Cloud Kubernetes CronJob or Job API activity by matching audit events where the recorded method name targets Kubernetes batch Job or CronJob resources. Attackers can use these scheduling and job primitives to run containerized, finite workloads on a cadence inside a cluster. The detection relies on Google Cloud audit telemetry that includes the Kubernetes API method name reported in gcp.audit events.
references:
  - https://cloud.google.com/kubernetes-engine/docs
  - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
  - https://kubernetes.io/docs/concepts/workloads/controllers/job/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-22
modified: 2022-12-25
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
logsource:
  product: gcp
  service: gcp.audit
detection:
  selection:
    gcp.audit.method_name:
      - io.k8s.api.batch.v*.Job
      - io.k8s.api.batch.v*.CronJob
  condition: selection
falsepositives:
  - Google Cloud Kubernetes CronJob/Job may be done by a system administrator.
  - If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
  - id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435
    type: derived