Kubernetes CronJob/Job Created or Modified via API Audit Events
Alert on Kubernetes batch CronJob/Job create or modification audit verbs that may enable scheduled workload execution.
FreeReviewedSigma · Medium · v5
- Product
- kubernetes
- Service
- audit
- Author
- kelnage (SigmaHQ), DRL 1.1
- Published
- 2024-07-11
- Updated
- 2026-07-31
What it detects
This rule flags Kubernetes API audit activity where a CronJob or Job in the batch API group is created or modified via verbs such as create, delete, patch, replace, or update. Adversaries may abuse these objects to schedule or trigger container execution in the cluster, potentially enabling persistence or repeated execution of malicious workloads. It relies on Kubernetes audit log telemetry capturing the object reference (apiGroup, resource) and the corresponding API verb.
Reporting behind it
- kubernetes.iohttps://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
- redhat.comhttps://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
kubernetes-audit-cronjob-job-create-or-modification-events-batch-api-0c9b3bda
title: Kubernetes CronJob/Job Created or Modified via API Audit Events
id: 6c3b7c7d-efa6-4705-801f-27c2956c9027
related:
- id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435
type: similar
- id: 0c9b3bda-41a6-4442-9345-356ae86343dc
type: derived
status: test
description: This rule flags Kubernetes API audit activity where a CronJob or Job in the batch API group is created or modified via verbs such as create, delete, patch, replace, or update. Adversaries may abuse these objects to schedule or trigger container execution in the cluster, potentially enabling persistence or repeated execution of malicious workloads. It relies on Kubernetes audit log telemetry capturing the object reference (apiGroup, resource) and the corresponding API verb.
references:
- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
- https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml
author: kelnage, Huntrule Team
date: 2024-07-11
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
logsource:
product: kubernetes
service: audit
detection:
selection:
objectRef.apiGroup: batch
objectRef.resource:
- cronjobs
- jobs
verb:
- create
- delete
- patch
- replace
- update
condition: selection
falsepositives:
- Modifying a Kubernetes Job or CronJob may need to be done by a system administrator.
- Automated processes may need to take these actions and may need to be filtered.
level: medium
license: DRL-1.1