OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where Action has_any ("admin' --" ,"admin' #", "admin'/*", "0=1", "1=0", "1=1", "1=2", "' or 1=1--", "' or 1=1#", "' or 1=1/*", "') or '1'='1--", "') or ('1'='1--")
| project SrcIpAddr, DstUserName, Action
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
description: |
'Detects common known SQL injection patterns used in automated scripts.'
kind: Scheduled
triggerOperator: gt
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSQLInjectionPatterns.yaml
tactics:
- InitialAccess
requiredDataConnectors:
- datatypes:
- Syslog
connectorId: SyslogAma
id: ab352f0d-7c55-4ab2-a22e-b1c2d995e193
queryFrequency: 1h
name: OracleDBAudit - SQL injection patterns
entityMappings:
- entityType: Account
fieldMappings:
- identifier: FullName
columnName: AccountCustomEntity
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
relevantTechniques:
- T1190
version: 1.0.2
triggerThreshold: 0
status: Available
queryPeriod: 1h
query: |
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where Action has_any ("admin' --" ,"admin' #", "admin'/*", "0=1", "1=0", "1=1", "1=2", "' or 1=1--", "' or 1=1#", "' or 1=1/*", "') or '1'='1--", "') or ('1'='1--")
| project SrcIpAddr, DstUserName, Action
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
severity: Medium
