OracleDBAudit - Shutdown Server

Back


Id	27cc2cdc-ba67-4906-a6ef-ecbc9c284f4e
Rulename	OracleDBAudit - Shutdown Server
Description	Detects when “SHUTDOWN” command was sent to server.
Severity	Medium
Tactics	Impact
Techniques	T1529
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditShutdownServer.yaml
Version	1.0.2
Arm template	27cc2cdc-ba67-4906-a6ef-ecbc9c284f4e.json

KQL

OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where DbAction =~ 'SHUTDOWN'
| project SrcIpAddr, DstUserName
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

queryPeriod: 1h
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where DbAction =~ 'SHUTDOWN'
  | project SrcIpAddr, DstUserName
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
name: OracleDBAudit - Shutdown Server
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditShutdownServer.yaml
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
description: |
    'Detects when "SHUTDOWN" command was sent to server.'
kind: Scheduled
version: 1.0.2
status: Available
severity: Medium
relevantTechniques:
- T1529
triggerOperator: gt
triggerThreshold: 0
tactics:
- Impact
id: 27cc2cdc-ba67-4906-a6ef-ecbc9c284f4e

ARM