OracleDBAudit - User activity after long inactivity time

Back


Id	5e93a535-036b-4570-9e58-d8992f30e1ae
Rulename	OracleDBAudit - User activity after long inactivity time
Description	Detects when an action was made by a user which last activity was observed more than 30 days ago.
Severity	Medium
Tactics	InitialAccess Persistence
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditRareUserActivity.yaml
Version	1.0.2
Arm template	5e93a535-036b-4570-9e58-d8992f30e1ae.json

KQL

let lbtime_14d = 14d;
let lbtime_7d = 7d;
let lbtime_24h = 24h;
let known_users_14d = OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_14d) .. ago(lbtime_14d))
| where isnotempty(DstUserName)
| where isnotempty(Action)
| summarize makeset(DstUserName);
let known_users_7d = OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_7d) .. ago(lbtime_24h))
| where isnotempty(DstUserName)
| where isnotempty(Action)
| summarize makeset(DstUserName);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| where DstUserName !in (known_users_7d)
| where DstUserName in (known_users_14d)
| project DstUserName
| extend AccountCustomEntity = DstUserName

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditRareUserActivity.yaml
queryPeriod: 14d
version: 1.0.2
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
relevantTechniques:
- T1078
queryFrequency: 1h
triggerOperator: gt
kind: Scheduled
query: |
  let lbtime_14d = 14d;
  let lbtime_7d = 7d;
  let lbtime_24h = 24h;
  let known_users_14d = OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_14d) .. ago(lbtime_14d))
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | summarize makeset(DstUserName);
  let known_users_7d = OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_7d) .. ago(lbtime_24h))
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | summarize makeset(DstUserName);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | where DstUserName !in (known_users_7d)
  | where DstUserName in (known_users_14d)
  | project DstUserName
  | extend AccountCustomEntity = DstUserName  
id: 5e93a535-036b-4570-9e58-d8992f30e1ae
tactics:
- InitialAccess
- Persistence
status: Available
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerThreshold: 0
name: OracleDBAudit - User activity after long inactivity time
severity: Medium
description: |
    'Detects when an action was made by a user which last activity was observed more than 30 days ago.'

ARM