OracleDBAudit - Connection to database from external IP

Back


Id	54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
Rulename	OracleDBAudit - Connection to database from external IP
Description	Detects when connection to database is from external IP source.
Severity	Medium
Tactics	InitialAccess Collection Exfiltration
Techniques	T1190 T1133 T1078 T1119 T1029
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
Version	1.0.2
Arm template	54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe.json

KQL

OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

relevantTechniques:
- T1190
- T1133
- T1078
- T1119
- T1029
name: OracleDBAudit - Connection to database from external IP
triggerThreshold: 0
tactics:
- InitialAccess
- Collection
- Exfiltration
severity: Medium
id: 54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
status: Available
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
kind: Scheduled
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where isnotempty(Action)
  | where DbAction =~ 'connect'
  | where ipv4_is_private(SrcIpAddr) == 'false'
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
description: |
    'Detects when connection to database is from external IP source.'
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
triggerOperator: gt
queryPeriod: 30m
queryFrequency: 30m
version: 1.0.2
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
- entityType: IP
  fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address

ARM