OracleDBAudit - Unusual user activity on multiple tables

Back


Id	75024e1c-26e7-4e73-821d-95e5decdd8db
Rulename	OracleDBAudit - Unusual user activity on multiple tables
Description	Detects when user queries many tables in short period of time.
Severity	Medium
Tactics	Collection
Techniques	T1119
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSelectOnManyTables.yaml
Version	1.0.2
Arm template	75024e1c-26e7-4e73-821d-95e5decdd8db.json

KQL

let tbl_threshold = 10;
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where DbAction =~ 'SELECT'
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName !~ 'SELECT'
| summarize tbl_count = dcount(TableName) by DstUserName, bucket = bin(TimeGenerated, 5m)
| where tbl_count > tbl_threshold
| extend AccountCustomEntity = DstUserName

YAML

triggerOperator: gt
id: 75024e1c-26e7-4e73-821d-95e5decdd8db
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSelectOnManyTables.yaml
triggerThreshold: 0
severity: Medium
queryFrequency: 1h
query: |
  let tbl_threshold = 10;
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where DbAction =~ 'SELECT'
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName !~ 'SELECT'
  | summarize tbl_count = dcount(TableName) by DstUserName, bucket = bin(TimeGenerated, 5m)
  | where tbl_count > tbl_threshold
  | extend AccountCustomEntity = DstUserName  
relevantTechniques:
- T1119
description: |
    'Detects when user queries many tables in short period of time.'
kind: Scheduled
version: 1.0.2
tactics:
- Collection
status: Available
name: OracleDBAudit - Unusual user activity on multiple tables
queryPeriod: 1h

ARM