kevmap

Techniques › T1053 › T1053.007

T1053.007 Container Orchestration Job

execution · persistence · privilege escalation — Containers · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
0
Sigma rules tagged attack.t1053.007
0
KEV CVEs mapped here
<p>Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.</p><p>In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks. An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1053.007

No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.

Rules tagged at the parent level (attack.t1053) 12

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

HackTool - CrackMapExec Execution Patterns highstable
Author: Thomas Patzke · 2020-05-22 (modified 2023-11-06) · logsource: product=windows category=process_creation · 058f4380-962d-40a5-afce-50207d36d7e2
Detects various execution patterns of the CrackMapExec pentesting framework
Techniques: T1047T1053T1059.003T1059.001
Remote Schedule Task Lateral Movement via ATSvc hightest
Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb
Detects remote RPC calls to create or execute a scheduled task via ATSvc
Techniques: T1053T1053.002
HackTool - SharPersist Execution hightest
Author: Florian Roth (Nextron Systems) · 2022-09-15 (modified 2023-02-04) · logsource: product=windows category=process_creation · 26488ad0-f9fd-4536-876f-52fea846a2e4
Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms
Techniques: T1053
HackTool - CrackMapExec Execution hightest
Author: Florian Roth (Nextron Systems) · 2022-02-25 (modified 2023-03-08) · logsource: product=windows category=process_creation · 42a993dd-bb3e-48c8-b372-4d6684c4106c
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Techniques: T1047T1053T1059.003T1059.001T1110T1201
Scheduled TaskCache Change by Uncommon Program hightest
Author: Syed Hasan (@syedhasan009) · 2021-06-18 (modified 2025-10-22) · logsource: product=windows category=registry_set · 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d
Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
Techniques: T1053T1053.005
Cisco Modify Configuration mediumtest
Author: Austin Clark · 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b
Modifications to a config that will serve an adversary's impacts or persistence
Techniques: T1490T1505T1565.002T1053
Suspicious Scheduled Task Write to System32 Tasks hightest
Author: Florian Roth (Nextron Systems) · 2021-11-16 (modified 2022-01-12) · logsource: product=windows category=file_event · 80e1f67a-4596-4351-98f5-a9c3efabac95
Detects the creation of tasks from processes executed from suspicious locations
Techniques: T1053
Remote Schedule Task Lateral Movement via ITaskSchedulerService hightest
Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d
Detects remote RPC calls to create or execute a scheduled task
Techniques: T1053T1053.002
Remote Schedule Task Lateral Movement via SASec hightest
Author: Sagie Dulce, Dekel Paz · 2022-01-01 · logsource: product=rpc_firewall category=application · aff229ab-f8cd-447b-b215-084d11e79eb0
Detects remote RPC calls to create or execute a scheduled task via SASec
Techniques: T1053T1053.002
HAFNIUM Exchange Exploitation Activity criticaltest
Author: Florian Roth (Nextron Systems) · 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Techniques: T1546T1053
Defrag Deactivation - Security mediumtest
Author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1) · 2019-03-04 (modified 2022-11-27) · logsource: product=windows service=security · c5a178bf-9cfb-4340-b584-e4df39b6a3e7
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
Techniques: T1053
Potential ACTINIUM Persistence Activity hightest
Author: Andreas Hunkeler (@Karneades) · 2022-02-07 (modified 2023-03-18) · logsource: product=windows category=process_creation · e1118a8f-82f5-44b3-bb6b-8a284e5df602
Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.
Techniques: T1053T1053.005