GCP Kubernetes CronJob or Job Creation via gcp.audit
Flags GCP audit events where Kubernetes batch Job/CronJob API methods indicate CronJob or Job execution setup.
FreeReviewedSigma · Medium · v4
- Product
- gcp
- Service
- gcp.audit
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-11-22
- Updated
- 2026-07-31
What it detects
This rule flags Google Cloud audit log events where a Kubernetes CronJob or Job API is invoked, indicating creation or execution scheduling of batch workloads. Attackers can abuse CronJobs/Jobs to run finite malicious containers on a schedule inside the cluster, providing a persistence-like execution pattern. The detection relies on gcp.audit method_name values matching Kubernetes batch Job and CronJob API endpoints.
Reporting behind it
- cloud.google.comhttps://cloud.google.com/kubernetes-engine/docs
- kubernetes.iohttps://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
- kubernetes.iohttps://kubernetes.io/docs/concepts/workloads/controllers/job/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml
Changelog
v4- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
gcp-audit-detects-kubernetes-cronjob-and-job-creation-requests-cd3a808c
title: GCP Kubernetes CronJob or Job Creation via gcp.audit
id: 71b786c1-13ea-42a7-9103-de147627a891
status: test
description: This rule flags Google Cloud audit log events where a Kubernetes CronJob or Job API is invoked, indicating creation or execution scheduling of batch workloads. Attackers can abuse CronJobs/Jobs to run finite malicious containers on a schedule inside the cluster, providing a persistence-like execution pattern. The detection relies on gcp.audit method_name values matching Kubernetes batch Job and CronJob API endpoints.
references:
- https://cloud.google.com/kubernetes-engine/docs
- https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
- https://kubernetes.io/docs/concepts/workloads/controllers/job/
- https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-11-22
modified: 2022-12-25
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
logsource:
product: gcp
service: gcp.audit
detection:
selection:
gcp.audit.method_name:
- io.k8s.api.batch.v*.Job
- io.k8s.api.batch.v*.CronJob
condition: selection
falsepositives:
- Google Cloud Kubernetes CronJob/Job may be done by a system administrator.
- If known behavior is causing false positives, it can be exempted from the rule.
level: medium
license: DRL-1.1
related:
- id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435
type: derived