OracleDBAudit - New user account

Back


Id	cca7b348-e904-4a7a-8f26-d22d4d477119
Rulename	OracleDBAudit - New user account
Description	Detects when an action was made by new user.
Severity	Low
Tactics	InitialAccess Persistence
Techniques	T1078
Required data connectors	SyslogAma
Kind	Scheduled
Query frequency	3h
Query period	14d
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditNewUserDetected.yaml
Version	1.0.2
Arm template	cca7b348-e904-4a7a-8f26-d22d4d477119.json

KQL

let lbtime_d = 14d;
let lbtime_24h = 24h;
let known_users = OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
| where isnotempty(DstUserName)
| where isnotempty(Action)
| summarize makeset(DstUserName);
OracleDatabaseAuditEvent
| where isnotempty(DstUserName)
| where isnotempty(Action)
| where DstUserName !in (known_users)
| project DstUserName
| extend AccountCustomEntity = DstUserName

YAML

name: OracleDBAudit - New user account
query: |
  let lbtime_d = 14d;
  let lbtime_24h = 24h;
  let known_users = OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | summarize makeset(DstUserName);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | where DstUserName !in (known_users)
  | project DstUserName
  | extend AccountCustomEntity = DstUserName  
queryFrequency: 3h
triggerOperator: gt
requiredDataConnectors:
- datatypes:
  - Syslog
  connectorId: SyslogAma
status: Available
entityMappings:
- entityType: Account
  fieldMappings:
  - identifier: FullName
    columnName: AccountCustomEntity
triggerThreshold: 0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/OracleDatabaseAudit/Analytic Rules/OracleDBAuditNewUserDetected.yaml
description: |
    'Detects when an action was made by new user.'
version: 1.0.2
id: cca7b348-e904-4a7a-8f26-d22d4d477119
kind: Scheduled
relevantTechniques:
- T1078
severity: Low
tactics:
- InitialAccess
- Persistence
queryPeriod: 14d

ARM