Sigma rule: Azure Kubernetes CronJob

Rule

Title

Azure Kubernetes CronJob

Status

test

Level

medium

Author

Austin Songer @austinsonger

Date

2021-11-22

Modified

2022-12-18

File

rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Log source

product

azure

service

activitylogs

Detection

selection:
    operationName|startswith:
        - 'MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/BATCH'
        - 'MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/BATCH'
    operationName|endswith:
        - '/CRONJOBS/WRITE'
        - '/JOBS/WRITE'
condition: selection

False positives (as the rule lists them)

• Azure Kubernetes CronJob/Job may be done by a system administrator.
• If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.persistence
• attack.t1053.003
• attack.privilege-escalation
• attack.execution

MITRE ATT&CK ids this rule names

• T1053.003

References

• https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
• https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
• https://kubernetes.io/docs/concepts/workloads/controllers/job/
• https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml