Scheduled Task/Job: Container Orchestration Job
- ID
- T1053.007
- Tactics
- TA0002 Execution, TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1053 Scheduled Task/Job
- Platforms
- Containers
- Data sources
- Scheduled Job Creation, Container Creation, Network Traffic Content
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.
In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.[2][3] An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.[4]
Detection
- DET0206 Detection of Malicious Kubernetes CronJob Scheduling
Data components: Scheduled Job Creation, Container Creation, Network Traffic Content
Mitigations (2)
- M1018 User Account Management
Limit privileges of user accounts and remediate privilege escalation vectors so only authorized administrators can create container orchestration jobs.
- M1026 Privileged Account Management
Ensure containers are not running as root by default. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers.[1]
References
- Kubernetes Hardening Guide
- Kubernetes Jobs
- Kubernetes CronJob
- Threat Matrix for Kubernetes