TA0002 · EXECUTION
Container Orchestration Job
Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code.
Detect it with
Monitor for the anomalous creation of scheduled jobs in container orchestration environments. Use logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application and resource pods to monitor malicious container orchestration job deployments.
Why it matters on shift
Container Orchestration Job is one of the concrete ways adversaries achieve execution. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After execution, the next tactic is usually Persistence. Search your telemetry for the transition before closing the ticket.
Kill-chain context