Sigma rule: Google Cloud Kubernetes CronJob

Rule

Title

Google Cloud Kubernetes CronJob

Status

test

Level

medium

Author

Austin Songer @austinsonger

Date

2021-11-22

Modified

2022-12-25

File

rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Identifies when a Google Cloud Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Log source

product

gcp

service

gcp.audit

Detection

selection:
    gcp.audit.method_name:
        - io.k8s.api.batch.v*.Job
        - io.k8s.api.batch.v*.CronJob
condition: selection

False positives (as the rule lists them)

• Google Cloud Kubernetes CronJob/Job may be done by a system administrator.
• If known behavior is causing false positives, it can be exempted from the rule.

Tags

• attack.persistence
• attack.privilege-escalation
• attack.execution

References

• https://cloud.google.com/kubernetes-engine/docs
• https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
• https://kubernetes.io/docs/concepts/workloads/controllers/job/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml