OracleDBAudit - User activity after long inactivity time

Back


Id	5e93a535-036b-4570-9e58-d8992f30e1ae
Rulename	OracleDBAudit - User activity after long inactivity time
Description	Detects when an action was made by a user which last activity was observed more than 30 days ago.
Severity	Medium
Tactics	InitialAccess Persistence
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditRareUserActivity.yaml
Version	1.0.2
Arm template	5e93a535-036b-4570-9e58-d8992f30e1ae.json

KQL

let lbtime_14d = 14d;
let lbtime_7d = 7d;
let lbtime_24h = 24h;
let known_users_14d = OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_14d) .. ago(lbtime_14d))
| where isnotempty(DstUserName)
| where isnotempty(Action)
| summarize makeset(DstUserName);
let known_users_7d = OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_7d) .. ago(lbtime_24h))
| where isnotempty(DstUserName)
| where isnotempty(Action)
| summarize makeset(DstUserName);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| where DstUserName !in (known_users_7d)
| where DstUserName in (known_users_14d)
| project DstUserName
| extend AccountCustomEntity = DstUserName

YAML

entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
severity: Medium
name: OracleDBAudit - User activity after long inactivity time
triggerThreshold: 0
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditRareUserActivity.yaml
id: 5e93a535-036b-4570-9e58-d8992f30e1ae
kind: Scheduled
status: Available
queryFrequency: 1h
relevantTechniques:
- T1078
description: |
    'Detects when an action was made by a user which last activity was observed more than 30 days ago.'
query: |
  let lbtime_14d = 14d;
  let lbtime_7d = 7d;
  let lbtime_24h = 24h;
  let known_users_14d = OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_14d) .. ago(lbtime_14d))
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | summarize makeset(DstUserName);
  let known_users_7d = OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_7d) .. ago(lbtime_24h))
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | summarize makeset(DstUserName);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | where DstUserName !in (known_users_7d)
  | where DstUserName in (known_users_14d)
  | project DstUserName
  | extend AccountCustomEntity = DstUserName  
version: 1.0.2
tactics:
- InitialAccess
- Persistence
queryPeriod: 14d
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma

ARM