Scheduled Task/Job: Container Orchestration Job

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.[1][2] An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in the cluster.[3]

ID: T1053.007
Sub-technique of:  T1053
Tactics: Execution, Persistence, Privilege Escalation
Platforms: Containers
Permissions Required: User
Data Sources: Container: Container Creation, File: File Creation, Scheduled Job: Scheduled Job Creation
Contributors: Center for Threat-Informed Defense (CTID); Vishwas Manral, McAfee; Yossi Weizman, Azure Defender Research Team
Version: 1.0
Created: 29 March 2021
Last Modified: 12 April 2021

Mitigations

ID Mitigation Description
M1026 Privileged Account Management

Ensure containers are not running as root by default.

M1018 User Account Management

Limit privileges of user accounts and remediate privilege escalation vectors so only authorized administrators can create container orchestration jobs.

Detection

Monitor for the anomalous creation of scheduled jobs in container orchestration environments. Use logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application and resource pods to monitor malicious container orchestration job deployments.

References