OracleDBAudit - Multiple tables dropped in short time

Back


Id	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
Rulename	OracleDBAudit - Multiple tables dropped in short time
Description	Detects when user drops many tables in short period of time.
Severity	Medium
Tactics	Impact
Techniques	T1485
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
Version	1.0.2
Arm template	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f.json

KQL

let tbl_threshold = 10;
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where DbAction =~ 'DROP'
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName !~ 'SELECT'
| summarize tbl_count = dcount(TableName) by DstUserName
| where tbl_count > tbl_threshold
| extend AccountCustomEntity = DstUserName

YAML

triggerThreshold: 0
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
name: OracleDBAudit - Multiple tables dropped in short time
relevantTechniques:
- T1485
status: Available
version: 1.0.2
queryPeriod: 30m
kind: Scheduled
id: b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
query: |
  let tbl_threshold = 10;
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where DbAction =~ 'DROP'
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName !~ 'SELECT'
  | summarize tbl_count = dcount(TableName) by DstUserName
  | where tbl_count > tbl_threshold
  | extend AccountCustomEntity = DstUserName  
description: |
    'Detects when user drops many tables in short period of time.'
queryFrequency: 30m
severity: Medium
triggerOperator: gt
tactics:
- Impact

ARM