OracleDBAudit - Connection to database from external IP

Back


Id	54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
Rulename	OracleDBAudit - Connection to database from external IP
Description	Detects when connection to database is from external IP source.
Severity	Medium
Tactics	InitialAccess Collection Exfiltration
Techniques	T1190 T1133 T1078 T1119 T1029
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
Version	1.0.2
Arm template	54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe.json

KQL

OracleDatabaseAuditEvent
| where isnotempty(SrcIpAddr)
| where isnotempty(Action)
| where DbAction =~ 'connect'
| where ipv4_is_private(SrcIpAddr) == 'false'
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

queryPeriod: 30m
description: |
    'Detects when connection to database is from external IP source.'
kind: Scheduled
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(SrcIpAddr)
  | where isnotempty(Action)
  | where DbAction =~ 'connect'
  | where ipv4_is_private(SrcIpAddr) == 'false'
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
tactics:
- InitialAccess
- Collection
- Exfiltration
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditConnectFromExternalIp.yaml
id: 54aa2c17-acfd-4e3a-a1c4-99c88cf34ebe
version: 1.0.2
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
- entityType: IP
  fieldMappings:
  - identifier: Address
    columnName: IPCustomEntity
triggerThreshold: 0
status: Available
relevantTechniques:
- T1190
- T1133
- T1078
- T1119
- T1029
name: OracleDBAudit - Connection to database from external IP
severity: Medium
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
queryFrequency: 30m

ARM