Scheduled Task/Job: Container Orchestration Job (T1053.007)

Tactics: Execution, Persistence, Privilege Escalation · Platforms: Containers

The interactive view maps 1 detection strategy, 2 mitigations to this technique, alongside D3FEND countermeasures and data-component coverage.

Sub-technique of Scheduled Task/Job (T1053).

Overview

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks. An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.

Explore

• Open T1053.007 in the interactive ATT&CK matrix
• ATT&CK Intelligence View guide
• Official MITRE ATT&CK entry for T1053.007
• Sigma detection rules for MITRE ATT&CK
• Built by Shahrukh Khan