Query: detect Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more in logs
Matching passage: Sigma rule: Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes CronJob id: 1c71e254-6655-42c1-b2d6-5e4718d7fc0a status: test description: 'Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ - https://kubernetes.io/docs/concepts/workloads/controllers/job/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ author: Austin Songer @austinsonger date: 2021-11-22 modified: 2022-12-18 tags: - attack.persistence - attack.t1053.003 - attack.privilege-escalation - attack.execution logsource: product: azure service: activitylogs detection: selection: operationName|startswith: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/BATCH - MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/BATCH operationName|endswith: - /CRONJOBS/WRITE - /JOBS/WRITE condition: selection falsepositives: - Azure Kubernetes CronJob/Job may be done by a system administrator. - If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and lo. Logsource: windows / process_creation. Rule: title: PUA - Kernel Driver Utility (KDU) Execution id: e76ca062-4de0-4d79-8d90-160a0d335eca status: experimental description: 'Detects execution of the Kernel Driver Utility (KDU) tool. KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel. Potentially allowing for privilege escalation, persistence, or evasion of security controls. ' references: - https://github.com/h4rmy/KDU - https://huntress.com/blog/esxi-vm-escape-exploit author: Matt Anderson, Dray Agha, Anna Pham (Huntress) date: 2026-01-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \kdu.exe - \hamakaze.exe - OriginalFileName: hamakaze.exe selection_cli_suspicious: CommandLine|contains: - '-map ' - '-prv ' - '-dse ' - '-ps ' condition: all of selection_* falsepositives: - Legitimate driver development, testing, or administrative troubleshooting (e.g., enabling/disabling hardware) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/info.yml