Suspicious Azure Kubernetes CronJob (via activitylogs)

title: Suspicious Azure Kubernetes CronJob (via activitylogs)
id: 8e95679e-d6a9-554e-a496-2403e9a92978
status: stable
description: This rule detects when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that generates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be leveraged to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is leveraged to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of hostile code that would run as a container in the cluster.
references:
    - https://attack.mitre.org/techniques/T1053/003/
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
    - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
    - https://kubernetes.io/docs/concepts/workloads/controllers/job/
    - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
author: Huntrule Team
date: 2026-04-28
tags:
    - attack.persistence
    - attack.t1053.003
    - attack.privilege-escalation
    - attack.execution
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName|startswith:
            - 'MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/BATCH'
            - 'MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/BATCH'
        operationName|endswith:
            - '/CRONJOBS/WRITE'
            - '/JOBS/WRITE'
    condition: selection
falsepositives:
    - Unknown
level: medium