OracleDBAudit - User connected to database from new IP

Back


Id	39a0995e-f4a9-4869-a0ae-36d6d9049bfd
Rulename	OracleDBAudit - User connected to database from new IP
Description	Detects when a user connects to database from new IP address.
Severity	Low
Tactics	InitialAccess
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditNewIpForUser.yaml
Version	1.0.2
Arm template	39a0995e-f4a9-4869-a0ae-36d6d9049bfd.json

KQL

let lbtime_d = 14d;
let lbtime_24h = 24h;
OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
| where isnotempty(SrcIpAddr)
| where isnotempty(DstUserName)
| summarize knownIPs = make_set(SrcIpAddr) by DstUserName
| join (OracleDatabaseAuditEvent
      | where isnotempty(SrcIpAddr)
      | where isnotempty(DstUserName)
      | where DbAction =~ 'connect'
      ) on DstUserName
| where knownIPs !contains SrcIpAddr
| project DstUserName, SrcIpAddr
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

query: |
  let lbtime_d = 14d;
  let lbtime_24h = 24h;
  OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
  | where isnotempty(SrcIpAddr)
  | where isnotempty(DstUserName)
  | summarize knownIPs = make_set(SrcIpAddr) by DstUserName
  | join (OracleDatabaseAuditEvent
        | where isnotempty(SrcIpAddr)
        | where isnotempty(DstUserName)
        | where DbAction =~ 'connect'
        ) on DstUserName
  | where knownIPs !contains SrcIpAddr
  | project DstUserName, SrcIpAddr
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
- fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
  entityType: IP
triggerOperator: gt
description: |
    'Detects when a user connects to database from new IP address.'
tactics:
- InitialAccess
severity: Low
queryFrequency: 1h
kind: Scheduled
name: OracleDBAudit - User connected to database from new IP
triggerThreshold: 0
status: Available
id: 39a0995e-f4a9-4869-a0ae-36d6d9049bfd
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
relevantTechniques:
- T1078
version: 1.0.2
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditNewIpForUser.yaml
queryPeriod: 14d

ARM