Suspicious container orchestration job

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	10 Minutes
Required Data	XDR Agent
ATT&CK Tactic	Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004)
ATT&CK Technique	Scheduled Task/Job: Container Orchestration Job (T1053.007)
Severity	Low

Description

A suspicious orchestration job ran with a rare command line.

Attacker's Goals

• Adversaries may abuse task scheduling functionality provided by container orchestration tools
• The adversaries do that to schedule deployment of containers configured to execute malicious code.

Investigative actions

Investigate The process activities and impact on the relevant container.