Merge pull request #863 from splunk/Kubernetes-Cron-Job

Kubernetes Cron Job
splunk · Dec 14, 2023 · 7282cde · 7282cde
2 parents 4f17acc + b1f0267
commit 7282cde
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/...ques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation.json b/...ques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation.json
diff --git a/...iques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation.yml b/...iques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation.yml
@@ -0,0 +1,11 @@
+author: Patrick Bareiss
+id: 18171239-e152-41f4-a1af-459d1b2aacb3
+date: '2023-12-14'
+description: Kubernetes audit logs which contains a creation of a cron job.
+environment: attack_range
+dataset:
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.007/kubernetes_audit_cron_job_creation/kubernetes_audit_cron_job_creation.json
+sourcetypes:
+- aws:cloudwatchlogs
+references:
+- https://attack.mitre.org/techniques/T1053/007