OracleDBAudit - Multiple tables dropped in short time

Back


Id	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
Rulename	OracleDBAudit - Multiple tables dropped in short time
Description	Detects when user drops many tables in short period of time.
Severity	Medium
Tactics	Impact
Techniques	T1485
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
Version	1.0.2
Arm template	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f.json

KQL

let tbl_threshold = 10;
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where DbAction =~ 'DROP'
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName !~ 'SELECT'
| summarize tbl_count = dcount(TableName) by DstUserName
| where tbl_count > tbl_threshold
| extend AccountCustomEntity = DstUserName

YAML

relevantTechniques:
- T1485
entityMappings:
- entityType: Account
  fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
version: 1.0.2
id: b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
severity: Medium
kind: Scheduled
queryFrequency: 30m
description: |
    'Detects when user drops many tables in short period of time.'
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
triggerOperator: gt
name: OracleDBAudit - Multiple tables dropped in short time
tactics:
- Impact
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
triggerThreshold: 0
queryPeriod: 30m
query: |
  let tbl_threshold = 10;
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where DbAction =~ 'DROP'
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName !~ 'SELECT'
  | summarize tbl_count = dcount(TableName) by DstUserName
  | where tbl_count > tbl_threshold
  | extend AccountCustomEntity = DstUserName  
status: Available

ARM