Detection rules › By event

Kubernetes-cronjobs

Event	Rules
get-cronjobs	1
list-cronjobs	1
watch-cronjobs	1
create-cronjobs	10
update-cronjobs	5
patch-cronjobs	9
delete-cronjobs	1

get-cronjobs

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

list-cronjobs

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

watch-cronjobs

1 detection rules reference this event. View event page.

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

create-cronjobs

10 detection rules reference this event. View event page.

Sigma (1)

Kubernetes CronJob/Job Modification severity medium

Elastic (5)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Unusual Sensitive Workload Modification severity low T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Unusual Kubernetes Sensitive Workload Modification severity low T1098, T1098.006

Splunk (1)

Kubernetes Cron Job Creation severity low T1053, T1053.007

Panther (3)

Kubernetes Cron Job Created or Modified severity medium
Kubernetes Cron Job Created or Modified
Kubernetes CronJob Created or Modified severity informational T1053.003

update-cronjobs

5 detection rules reference this event. View event page.

Sigma (1)

Kubernetes CronJob/Job Modification severity medium

Elastic (1)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610

Panther (3)

Kubernetes Cron Job Created or Modified severity medium
Kubernetes Cron Job Created or Modified
Kubernetes CronJob Created or Modified severity informational T1053.003

patch-cronjobs

9 detection rules reference this event. View event page.

Sigma (1)

Kubernetes CronJob/Job Modification severity medium

Elastic (5)

Direct Interactive Kubernetes API Request by Unusual Utilities severity low T1059, T1059.004, T1069, T1087, T1609, T1610
GKE Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
GKE Unusual Sensitive Workload Modification severity low T1098, T1098.006
Kubernetes Sensitive RBAC Change Followed by Workload Modification severity medium T1098, T1098.006
Unusual Kubernetes Sensitive Workload Modification severity low T1098, T1098.006

Panther (3)

Kubernetes Cron Job Created or Modified severity medium
Kubernetes Cron Job Created or Modified
Kubernetes CronJob Created or Modified severity informational T1053.003

delete-cronjobs

1 detection rules reference this event. View event page.

Sigma (1)

Kubernetes CronJob/Job Modification severity medium