Suspicious Google Cloud Kubernetes CronJob (via gcp.audit)

title: Suspicious Google Cloud Kubernetes CronJob (via gcp.audit)
id: cf6144a4-d535-5962-80ad-5e141c3a7b7f
status: stable
description: This rule detects when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that generates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be leveraged to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is leveraged to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of hostile code that would run as a container in the cluster.
references:
    - https://cloud.google.com/kubernetes-engine/docs
    - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
    - https://kubernetes.io/docs/concepts/workloads/controllers/job/
author: Huntrule Team
date: 2026-04-30
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.t1053.007
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name:
            - io.k8s.api.batch.v*.Job
            - io.k8s.api.batch.v*.CronJob
    condition: selection
falsepositives:
    - Unknown
level: medium