Name:Cisco Isovalent - Cron Job Creation id:94531a31-a041-4777-909f-cd92ed3b71ad version:5 date:None author:Bhavin Patel, Splunk status:production type:Anomaly Description:The following analytic detects the creation of a cron job within the Cisco Isovalent environment. It identifies this activity by monitoring process execution logs for cron job creation events. This behavior is significant for a SOC as it could allow an attacker to execute malicious tasks repeatedly and automatically, posing a threat to the Kubernetes infrastructure. If confirmed malicious, this activity could lead to persistent attacks, service disruptions, or unauthorized access to sensitive information. Data_source:
-Cisco Isovalent Process Exec
search:`cisco_isovalent_process_exec` process_name IN ("crond","cron","crontab") | search pod_name!="" | stats count min(_time) as firstTime max(_time) as lastTime values(process) as process by cluster_name pod_name parent_process_name process_name process_exec process_id node_name | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cisco_isovalent___cron_job_creation_filter`
how_to_implement:The detection is based on process execution data generated by Cisco Isovalent Runtime Security. Ensure that Isovalent Runtime Security is deployed and configured in your Kubernetes environment to emit process_exec events. Configure the Cisco Security Cloud TA to collect these logs via HTTP Event Collector (HEC) and normalize them into the Splunk Common Information Model. This integration ensures that all relevant pod, container, and process activity is captured for monitoring and detection of suspicious behavior. known_false_positives:This activity may be triggered by legitimate administrative scripts, container images, or third-party operators that use cron for scheduled tasks, so please investigate the alert in context to rule out benign operations. References: -https://attack.mitre.org/techniques/T1053/003/ -https://medium.com/@bag0zathev2/cronjobs-for-hackers-bugbounty-article-7d51588d0fd5 -https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ drilldown_searches: name:'View the detection results for - "$pod_name$"' search:'%original_detection_search% | search pod_name = "$pod_name$"' earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View risk events for the last 7 days for - "$pod_name$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$pod_name$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Cisco Isovalent Suspicious Activity']
