OracleDBAudit - Multiple tables dropped in short time

Back


Id	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
Rulename	OracleDBAudit - Multiple tables dropped in short time
Description	Detects when user drops many tables in short period of time.
Severity	Medium
Tactics	Impact
Techniques	T1485
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
Version	1.0.2
Arm template	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f.json

KQL

let tbl_threshold = 10;
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where DbAction =~ 'DROP'
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName !~ 'SELECT'
| summarize tbl_count = dcount(TableName) by DstUserName
| where tbl_count > tbl_threshold
| extend AccountCustomEntity = DstUserName

YAML

tactics:
- Impact
relevantTechniques:
- T1485
version: 1.0.2
triggerOperator: gt
name: OracleDBAudit - Multiple tables dropped in short time
id: b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
description: |
    'Detects when user drops many tables in short period of time.'
queryFrequency: 30m
severity: Medium
status: Available
query: |
  let tbl_threshold = 10;
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where DbAction =~ 'DROP'
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName !~ 'SELECT'
  | summarize tbl_count = dcount(TableName) by DstUserName
  | where tbl_count > tbl_threshold
  | extend AccountCustomEntity = DstUserName  
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
queryPeriod: 30m
triggerThreshold: 0
kind: Scheduled
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
  entityType: Account
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma

ARM