T1053.007sub-technique of T1053 Scheduled Task/Job
Container Orchestration Job
Containersnothing on this site yetT1053.007 on attack.mitre.org
Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Detection of Malicious Kubernetes CronJob Scheduling
- Detects abuse of container orchestration platforms (e.g., Kubernetes) where adversaries create CronJobs to maintain persistence or execute malicious Jobs across the cluster.
what reduces it
- M1018 User Account Management. Limit privileges of user accounts and remediate privilege escalation vectors so only authorized administrators can create container orchestration jobs.
- M1026 Privileged Account Management. Ensure containers are not running as root by default. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers.