OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where Action has_any ("admin' --" ,"admin' #", "admin'/*", "0=1", "1=0", "1=1", "1=2", "' or 1=1--", "' or 1=1#", "' or 1=1/*", "') or '1'='1--", "') or ('1'='1--")
| project SrcIpAddr, DstUserName, Action
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
id: ab352f0d-7c55-4ab2-a22e-b1c2d995e193
name: OracleDBAudit - SQL injection patterns
entityMappings:
- entityType: Account
fieldMappings:
- columnName: AccountCustomEntity
identifier: FullName
- entityType: IP
fieldMappings:
- columnName: IPCustomEntity
identifier: Address
version: 1.0.2
queryFrequency: 1h
status: Available
kind: Scheduled
triggerThreshold: 0
relevantTechniques:
- T1190
triggerOperator: gt
queryPeriod: 1h
severity: Medium
tactics:
- InitialAccess
description: |
'Detects common known SQL injection patterns used in automated scripts.'
query: |
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where Action has_any ("admin' --" ,"admin' #", "admin'/*", "0=1", "1=0", "1=1", "1=2", "' or 1=1--", "' or 1=1#", "' or 1=1/*", "') or '1'='1--", "') or ('1'='1--")
| project SrcIpAddr, DstUserName, Action
| extend AccountCustomEntity = DstUserName
| extend IPCustomEntity = SrcIpAddr
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditSQLInjectionPatterns.yaml
requiredDataConnectors:
- connectorId: SyslogAma
datatypes:
- Syslog
