Kubernetes Audit: CronJob/Job Create or Modification Events (batch API)

Alert on Kubernetes batch CronJob/Job create or modification audit verbs that may enable scheduled workload execution.

FreeUnreviewedSigmamediumv1

kubernetes-audit-cronjob-job-create-or-modification-events-batch-api-0c9b3bda

title: "Kubernetes Audit: CronJob/Job Create or Modification Events (batch API)"
id: 6c3b7c7d-efa6-4705-801f-27c2956c9027
related:
  - id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435
    type: similar
  - id: 0c9b3bda-41a6-4442-9345-356ae86343dc
    type: derived
status: test
description: This rule flags Kubernetes API audit events where a CronJob or Job in the batch API group is created or modified. Such changes are important because attackers may use these workload resources to schedule or run malicious container tasks within a cluster. The detection relies on Kubernetes audit logs that record the object reference (cronjobs/jobs) and the HTTP verb (create, delete, patch, replace, update).
references:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.apiGroup: batch
    objectRef.resource:
      - cronjobs
      - jobs
    verb:
      - create
      - delete
      - patch
      - replace
      - update
  condition: selection
falsepositives:
  - Modifying a Kubernetes Job or CronJob may need to be done by a system administrator.
  - Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1

What it detects

This rule flags Kubernetes API audit events where a CronJob or Job in the batch API group is created or modified. Such changes are important because attackers may use these workload resources to schedule or run malicious container tasks within a cluster. The detection relies on Kubernetes audit logs that record the object reference (cronjobs/jobs) and the HTTP verb (create, delete, patch, replace, update).

Known false positives

Modifying a Kubernetes Job or CronJob may need to be done by a system administrator.
Automated processes may need to take these actions and may need to be filtered.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.