Google Cloud Kubernetes CronJob or Job Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•30

This rule identifies the creation or modification of Kubernetes Jobs or CronJobs within a Google Cloud environment. Adversaries may use these scheduled tasks to maintain persistence, execute malicious code, or escalate privileges within a Kubernetes cluster by scheduling containers to run at specific times or intervals.