OracleDBAudit - SQL injection patterns

Back


Id	ab352f0d-7c55-4ab2-a22e-b1c2d995e193
Rulename	OracleDBAudit - SQL injection patterns
Description	Detects common known SQL injection patterns used in automated scripts.
Severity	Medium
Tactics	InitialAccess
Techniques	T1190
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSQLInjectionPatterns.yaml
Version	1.0.2
Arm template	ab352f0d-7c55-4ab2-a22e-b1c2d995e193.json

KQL

OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where Action has_any ("admin' --" ,"admin' #", "admin'/*", "0=1", "1=0", "1=1", "1=2", "' or 1=1--", "' or 1=1#", "' or 1=1/*", "') or '1'='1--", "') or ('1'='1--")
| project SrcIpAddr, DstUserName, Action
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr

YAML

name: OracleDBAudit - SQL injection patterns
id: ab352f0d-7c55-4ab2-a22e-b1c2d995e193
description: |
    'Detects common known SQL injection patterns used in automated scripts.'
triggerThreshold: 0
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
- fieldMappings:
  - columnName: IPCustomEntity
    identifier: Address
  entityType: IP
version: 1.0.2
triggerOperator: gt
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where Action has_any ("admin' --" ,"admin' #", "admin'/*", "0=1", "1=0", "1=1", "1=2", "' or 1=1--", "' or 1=1#", "' or 1=1/*", "') or '1'='1--", "') or ('1'='1--")
  | project SrcIpAddr, DstUserName, Action
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr  
tactics:
- InitialAccess
kind: Scheduled
queryFrequency: 1h
severity: Medium
queryPeriod: 1h
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSQLInjectionPatterns.yaml
relevantTechniques:
- T1190

ARM