Oracle - Command in URI

Back


Id	6ae36a5e-573f-11ec-bf63-0242ac130002
Rulename	Oracle - Command in URI
Description	Detects command in URI
Severity	High
Tactics	InitialAccess
Techniques	T1190 T1133
Required data connectors	CustomLogsAma
Kind	Scheduled
Query frequency	15m
Query period	15m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicCommandInURI.yaml
Version	1.0.3
Arm template	6ae36a5e-573f-11ec-bf63-0242ac130002.json

KQL

OracleWebLogicServerEvent
| where UrlOriginal has_any ('cat%20/etc/passwd', '/etc/passwd', 'ping -i', '/usr/bin/id(', '%2f%75%73%72%2f%62%69%6e%2f%69%64', 'phpinfo()' , '%70%68%70%69%6e%66%6f%28%29', ';id', '%3b%69%64', '/bin/bash -c', '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27', '/bin/bash', '%2f%62%69%6e%2f%62%61%73%68', 'sleep(', '%73%6c%65%65%70%28', 'curl', '%63%75%72%6c', '&dir', '%26%64%69%72', '& dir', '%26%20%64%69%72', '<script>', '%3c%73%63%72%69%70%74%3e', 'eval(', '%65%76%61%6c%28', 'exec(', '%65%78%65%63%28' , 'whoami', '%77%68%6f%61%6d%69', 'wget', 'python', 'gcc' , 'uname', 'systeminfo', '%77%67%65%74', '%70%79%74%68%6f%6e', '%75%6e%61%6d%65', '%73%79%73%74%65%6d%69%6e%66%6f') 
| extend UrlCustomEntity = UrlOriginal

YAML

description: |
    'Detects command in URI'
version: 1.0.3
triggerThreshold: 0
tactics:
- InitialAccess
queryPeriod: 15m
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleWebLogicServer/Analytic Rules/OracleWebLogicCommandInURI.yaml
triggerOperator: gt
status: Available
id: 6ae36a5e-573f-11ec-bf63-0242ac130002
name: Oracle - Command in URI
queryFrequency: 15m
severity: High
kind: Scheduled
entityMappings:
- fieldMappings:
  - columnName: UrlCustomEntity
    identifier: Url
  entityType: URL
relevantTechniques:
- T1190
- T1133
query: |
  OracleWebLogicServerEvent
  | where UrlOriginal has_any ('cat%20/etc/passwd', '/etc/passwd', 'ping -i', '/usr/bin/id(', '%2f%75%73%72%2f%62%69%6e%2f%69%64', 'phpinfo()' , '%70%68%70%69%6e%66%6f%28%29', ';id', '%3b%69%64', '/bin/bash -c', '%2f%62%69%6e%2f%62%61%73%68%20%2d%63%27', '/bin/bash', '%2f%62%69%6e%2f%62%61%73%68', 'sleep(', '%73%6c%65%65%70%28', 'curl', '%63%75%72%6c', '&dir', '%26%64%69%72', '& dir', '%26%20%64%69%72', '<script>', '%3c%73%63%72%69%70%74%3e', 'eval(', '%65%76%61%6c%28', 'exec(', '%65%78%65%63%28' , 'whoami', '%77%68%6f%61%6d%69', 'wget', 'python', 'gcc' , 'uname', 'systeminfo', '%77%67%65%74', '%70%79%74%68%6f%6e', '%75%6e%61%6d%65', '%73%79%73%74%65%6d%69%6e%66%6f') 
  | extend UrlCustomEntity = UrlOriginal  
requiredDataConnectors:
- dataTypes:
  - OracleWebLogicServer_CL
  connectorId: CustomLogsAma

ARM