OracleDBAudit - Connection to database from external IP

Back


Id	54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
Rulename	OracleDBAudit - Connection to database from external IP
Description	Detects when connection to database is from external IP source.
Severity	Medium
Tactics	InitialAccess Collection Exfiltration
Techniques	T1190 T1133 T1078 T1119 T1029
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
Version	1.0.2
Arm template	54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe.json

KQL

OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

triggerThreshold: 0
queryFrequency: 30m
id: 54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
kind: Scheduled
description: |
    'Detects when connection to database is from external IP source.'
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
queryPeriod: 30m
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where isnotempty(Action)
  | where DbAction =~ 'connect'
  | where ipv4_is_private(SrcIpAddr) == 'false'
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
severity: Medium
name: OracleDBAudit - Connection to database from external IP
tactics:
- InitialAccess
- Collection
- Exfiltration
version: 1.0.2
status: Available
triggerOperator: gt
relevantTechniques:
- T1190
- T1133
- T1078
- T1119
- T1029

ARM