MITRE ATT&CKsub-technique

T1053.007 Container Orchestration Job

Published 2021-03-29 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Execution, Persistence, Privilege Escalation
Platforms
Containers
Version
1.4
Created
2021-03-29

Description

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster. In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks. An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1053 Scheduled Task/Job technique

Tactic · MITRE ATT&CK (3)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation

Referenced by Compliance · mitigates (8)

  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control

References