tfMITRE ATT&CK sub-technique

Container Orchestration Job T1053.007

sub-technique of T1053 Scheduled Task/Job

Tactics: Execution, Persistence, Privilege Escalation
Platform: Containers
Version: 1.4
Created: 29 March 2021
Last modified: 24 October 2025
Contributors: Center for Threat-Informed Defense (CTID); Vishwas Manral, McAfee; Yossi Weizman, Azure Defender Research Team

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules50th pct

Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.

Offense vs defense T1053.007

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 2

first rule: 2024 Q1

Container Orchestration Job detection strategy DET0206

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Malicious Kubernetes CronJob Scheduling

Enterprise

1 platform

AN0582 · Containers

Detects abuse of container orchestration platforms (e.g., Kubernetes) where adversaries create CronJobs to maintain persistence or execute malicious Jobs across the cluster.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Scheduled Job CreationDC0001	kubernetes:apiserver	verb=create, resource=cronjobs, group=batch
Container CreationDC0072	kubernetes:events	container start/stop activity via Docker, containerd, or CRI-O
Network Traffic ContentDC0085	container:proxy	outbound/inbound network activity from spawned pods

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
NamespaceScope	Kubernetes namespace the job is deployed to—scoping this to known trusted namespaces may reduce noise.
ImageRepository	The container image registry or repository the job pulls from—can be filtered by trusted registries.
ScheduleWindow	Time window or frequency of CronJob execution (e.g., ‘@hourly’)—jobs running at odd hours may be suspicious.
ExecutionCommand	The command or entrypoint executed by the Job—unexpected shell commands or interpreters may warrant inspection.

Tests2Executorsbash 2Need elevation0 of 2Have prerequisites2Have cleanup1Platformscontainers

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

ListCronjobs

containers

bash

—

Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Input arguments

Name	Type	Default	Description
namespace	string	default	K8s namespace to list

Attack command

kubectl get cronjobs -n #{namespace}

Prerequisite

kubectl must be installed

Check

which kubectl

Satisfy

echo "kubectl must be installed manually"

GUIDab5ed03e-4208-4c6c-b28e-5bc3fdbb6fbe

CreateCronjob

containers

bash

—

Yes

Input arguments

Name	Type	Default	Description
namespace	string	default	K8s namespace to list

Attack command

kubectl create -f src/cronjob.yaml -n #{namespace}

Cleanup command

kubectl delete cronjob art -n #{namespace}

Prerequisite

kubectl must be installed

Check

which kubectl

Satisfy

echo "kubectl must be installed manually"

GUIDd768eb9c-b426-4cac-aa44-e8fe65b1a8c0

Tests from Atomic Red Team (MIT licence) · technique definition

Container Orchestration Job detections T1053.007

2 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

50th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs