T1053.007 Container Orchestration Job

> Sub-technique of: T1053

High-Level Description

Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code. Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system. Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks. An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.

Kill Chain Phase

• Execution (TA0002)
• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Containers

What to Check

• ] Identify if Container Orchestration Job technique is applicable to target environment
• ] Check Containers systems for indicators of Container Orchestration Job
• ] Verify mitigations are bypassed or absent (2 known mitigations)
• ] Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: ListCronjobs

Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Supported Platforms: containers

bash
kubectl get cronjobs -n #{namespace}

Dependencies:

• kubectl must be installed

Atomic Test 2: CreateCronjob

Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. Attackers may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.

Supported Platforms: containers

bash
kubectl create -f src/cronjob.yaml -n #{namespace}

Dependencies:

• kubectl must be installed

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Container Orchestration Job by examining the target platforms (Containers).

1. Assess Existing Defenses: Review whether mitigations for T1053.007 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

1. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1018 User Account Management

Limit privileges of user accounts and remediate privilege escalation vectors so only authorized administrators can create container orchestration jobs.

M1026 Privileged Account Management

Ensure containers are not running as root by default. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers.

Detection

Detection of Malicious Kubernetes CronJob Scheduling

Risk Assessment

| Finding | Severity | Impact | | ------------------------------------------------ | -------- | --------- | | Container Orchestration Job technique applicable | Low | Execution |

CWE Categories

| CWE ID | Title | | ------ | -------------------------------------- | | CWE-94 | Improper Control of Generation of Code |

References

• Kubernetes CronJob
• Kubernetes Jobs
• Threat Matrix for Kubernetes
• Atomic Red Team - T1053.007
• MITRE ATT&CK - T1053.007