OracleDBAudit - User connected to database from new IP

Back


Id	39a0995e-f4a9-4869-a0ae-36d6d9049bfd
Rulename	OracleDBAudit - User connected to database from new IP
Description	Detects when a user connects to database from new IP address.
Severity	Low
Tactics	InitialAccess
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditNewIpForUser.yaml
Version	1.0.2
Arm template	39a0995e-f4a9-4869-a0ae-36d6d9049bfd.json

KQL

let lbtime_d = 14d;
let lbtime_24h = 24h;
OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
| where isnotempty(SrcIpAddr)
| where isnotempty(DstUserName)
| summarize knownIPs = make_set(SrcIpAddr) by DstUserName
| join (OracleDatabaseAuditEvent
      | where isnotempty(SrcIpAddr)
      | where isnotempty(DstUserName)
      | where DbAction =~ 'connect'
      ) on DstUserName
| where knownIPs !contains SrcIpAddr
| project DstUserName, SrcIpAddr
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

triggerOperator: gt
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
triggerThreshold: 0
severity: Low
query: |
  let lbtime_d = 14d;
  let lbtime_24h = 24h;
  OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
  | where isnotempty(SrcIpAddr)
  | where isnotempty(DstUserName)
  | summarize knownIPs = make_set(SrcIpAddr) by DstUserName
  | join (OracleDatabaseAuditEvent
        | where isnotempty(SrcIpAddr)
        | where isnotempty(DstUserName)
        | where DbAction =~ 'connect'
        ) on DstUserName
  | where knownIPs !contains SrcIpAddr
  | project DstUserName, SrcIpAddr
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
tactics:
- InitialAccess
queryPeriod: 14d
version: 1.0.2
queryFrequency: 1h
description: |
    'Detects when a user connects to database from new IP address.'
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditNewIpForUser.yaml
name: OracleDBAudit - User connected to database from new IP
id: 39a0995e-f4a9-4869-a0ae-36d6d9049bfd
relevantTechniques:
- T1078
kind: Scheduled
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma

ARM