OracleDBAudit - Unusual user activity on multiple tables

Back


Id	75024e1c-26e7-4e73-821d-95e5decdd8db
Rulename	OracleDBAudit - Unusual user activity on multiple tables
Description	Detects when user queries many tables in short period of time.
Severity	Medium
Tactics	Collection
Techniques	T1119
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSelectOnManyTables.yaml
Version	1.0.2
Arm template	75024e1c-26e7-4e73-821d-95e5decdd8db.json

KQL

let tbl_threshold = 10;
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where DbAction =~ 'SELECT'
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName !~ 'SELECT'
| summarize tbl_count = dcount(TableName) by DstUserName, bucket = bin(TimeGenerated, 5m)
| where tbl_count > tbl_threshold
| extend AccountCustomEntity = DstUserName

YAML

relevantTechniques:
- T1119
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
version: 1.0.2
id: 75024e1c-26e7-4e73-821d-95e5decdd8db
severity: Medium
kind: Scheduled
queryFrequency: 1h
description: |
    'Detects when user queries many tables in short period of time.'
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerOperator: gt
name: OracleDBAudit - Unusual user activity on multiple tables
tactics:
- Collection
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSelectOnManyTables.yaml
triggerThreshold: 0
queryPeriod: 1h
query: |
  let tbl_threshold = 10;
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where DbAction =~ 'SELECT'
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName !~ 'SELECT'
  | summarize tbl_count = dcount(TableName) by DstUserName, bucket = bin(TimeGenerated, 5m)
  | where tbl_count > tbl_threshold
  | extend AccountCustomEntity = DstUserName  
status: Available

ARM