OracleDBAudit - Multiple tables dropped in short time

Back


Id	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
Rulename	OracleDBAudit - Multiple tables dropped in short time
Description	Detects when user drops many tables in short period of time.
Severity	Medium
Tactics	Impact
Techniques	T1485
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
Version	1.0.2
Arm template	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f.json

KQL

let tbl_threshold = 10;
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where DbAction =~ 'DROP'
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName !~ 'SELECT'
| summarize tbl_count = dcount(TableName) by DstUserName
| where tbl_count > tbl_threshold
| extend AccountCustomEntity = DstUserName

YAML

name: OracleDBAudit - Multiple tables dropped in short time
id: b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
query: |
  let tbl_threshold = 10;
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where DbAction =~ 'DROP'
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName !~ 'SELECT'
  | summarize tbl_count = dcount(TableName) by DstUserName
  | where tbl_count > tbl_threshold
  | extend AccountCustomEntity = DstUserName  
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
relevantTechniques:
- T1485
description: |
    'Detects when user drops many tables in short period of time.'
queryPeriod: 30m
status: Available
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
kind: Scheduled
triggerOperator: gt
severity: Medium
version: 1.0.2
queryFrequency: 30m
tactics:
- Impact
triggerThreshold: 0
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog

ARM