T1053.007 — Container Orchestration Job

Tactics: Execution, Persistence, Privilege Escalation · Platforms: Containers

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a…

Sub-technique of Scheduled Task/Job (T1053).

Sigma detection rules (1)

T1053.007 Scheduled Task/Job: Container Orchestration Job

title: "T1053.007 Scheduled Task/Job: Container Orchestration Job"
id: dbb6b4a7-fc0f-4a00-8fac-2f47f38f2844
description: 'Detection of Malicious Kubernetes CronJob Scheduling. (Data Component: Scheduled Job Creation; baseline tier: fallback.) Tune using: NamespaceScope, ImageRepository, ScheduleWindow, ExecutionCommand.'
references:
  - https://attack.mitre.org/techniques/T1053/007
author: Shahrukh Khan
date: 2026-02-02
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.007

logsource:
  product: kubernetes
  service: apiserver

detection:
  selection:
    verb: 'create'
    objectRef.resource: 'cronjobs'
  selection_suspicious:
    requestObject.spec.jobTemplate.spec.template.spec.containers|contains|all:
      - 'curl'
      - 'sh'

  condition: selection and selection_suspicious

falsepositives:
  - Legitimate operational cron jobs that use curl and shell for routine health checks or data pulls.

level: high

Related sub-techniques

Explore