OracleDBAudit - Unusual user activity on multiple tables

Back


Id	75024e1c-26e7-4e73-821d-95e5decdd8db
Rulename	OracleDBAudit - Unusual user activity on multiple tables
Description	Detects when user queries many tables in short period of time.
Severity	Medium
Tactics	Collection
Techniques	T1119
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSelectOnManyTables.yaml
Version	1.0.2
Arm template	75024e1c-26e7-4e73-821d-95e5decdd8db.json

KQL

let tbl_threshold = 10;
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where DbAction =~ 'SELECT'
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName !~ 'SELECT'
| summarize tbl_count = dcount(TableName) by DstUserName, bucket = bin(TimeGenerated, 5m)
| where tbl_count > tbl_threshold
| extend AccountCustomEntity = DstUserName

YAML

name: OracleDBAudit - Unusual user activity on multiple tables
severity: Medium
description: |
    'Detects when user queries many tables in short period of time.'
version: 1.0.2
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
tactics:
- Collection
relevantTechniques:
- T1119
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
triggerThreshold: 0
status: Available
queryPeriod: 1h
kind: Scheduled
triggerOperator: gt
query: |
  let tbl_threshold = 10;
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where DbAction =~ 'SELECT'
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName !~ 'SELECT'
  | summarize tbl_count = dcount(TableName) by DstUserName, bucket = bin(TimeGenerated, 5m)
  | where tbl_count > tbl_threshold
  | extend AccountCustomEntity = DstUserName  
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSelectOnManyTables.yaml
id: 75024e1c-26e7-4e73-821d-95e5decdd8db

ARM