OracleDBAudit - Multiple tables dropped in short time

Back


Id	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
Rulename	OracleDBAudit - Multiple tables dropped in short time
Description	Detects when user drops many tables in short period of time.
Severity	Medium
Tactics	Impact
Techniques	T1485
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	30m
Query period	30m
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
Version	1.0.2
Arm template	b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f.json

KQL

let tbl_threshold = 10;
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where DbAction =~ 'DROP'
| extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
| where isnotempty(TableName)
| where TableName !~ 'SELECT'
| summarize tbl_count = dcount(TableName) by DstUserName
| where tbl_count > tbl_threshold
| extend AccountCustomEntity = DstUserName

YAML

OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditDropManyTables.yaml
queryPeriod: 30m
kind: Scheduled
name: OracleDBAudit - Multiple tables dropped in short time
status: Available
entityMappings:
- fieldMappings:
  - columnName: AccountCustomEntity
    identifier: FullName
  entityType: Account
tactics:
- Impact
description: |
    'Detects when user drops many tables in short period of time.'
severity: Medium
requiredDataConnectors:
- connectorId: SyslogAma
  datatypes:
  - Syslog
queryFrequency: 30m
triggerThreshold: 0
version: 1.0.2
query: |
  let tbl_threshold = 10;
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where DbAction =~ 'DROP'
  | extend TableName = replace(@'[,\(\)]', '', extract(@'(?i)SELECT(.*?)FROM\s(.*?)\s', 2, Action))
  | where isnotempty(TableName)
  | where TableName !~ 'SELECT'
  | summarize tbl_count = dcount(TableName) by DstUserName
  | where tbl_count > tbl_threshold
  | extend AccountCustomEntity = DstUserName  
relevantTechniques:
- T1485
id: b3aa0e5a-75a2-4613-80ec-93a1be3aeb8f
triggerOperator: gt

ARM