Oracle suspicious command execution

Back


Id	e6c5ff42-0f42-4cec-994a-dabb92fe36e1
Rulename	Oracle suspicious command execution
Description	The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database.
Severity	Medium
Tactics	LateralMovement PrivilegeEscalation
Techniques	T1210 T1611
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OracleSuspiciousCommandExecution.yaml
Version	1.0.0
Arm template	e6c5ff42-0f42-4cec-994a-dabb92fe36e1.json

KQL

let timeframe= 1h;
DeviceProcessEvents
| where Timestamp >= ago(timeframe)
| where InitiatingProcessFileName =~ "oracle.exe"
| where not(FileName in~ ("conhost.exe", "oradim.exe"))
// Begin allow-list.
// End allow-list.

YAML

description: |
    The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database.
kind: Scheduled
tactics:
- LateralMovement
- PrivilegeEscalation
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OracleSuspiciousCommandExecution.yaml
severity: Medium
name: Oracle suspicious command execution
triggerThreshold: 0
queryPeriod: 1h
query: |
  let timeframe= 1h;
  DeviceProcessEvents
  | where Timestamp >= ago(timeframe)
  | where InitiatingProcessFileName =~ "oracle.exe"
  | where not(FileName in~ ("conhost.exe", "oradim.exe"))
  // Begin allow-list.
  // End allow-list.  
relevantTechniques:
- T1210
- T1611
id: e6c5ff42-0f42-4cec-994a-dabb92fe36e1
queryFrequency: 1h
status: Available
triggerOperator: gt
version: 1.0.0
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DeviceName
    identifier: FullName
- entityType: Account
  fieldMappings:
  - columnName: AccountSid
    identifier: Sid
  - columnName: AccountName
    identifier: Name
  - columnName: AccountDomain
    identifier: NTDomain
- entityType: Process
  fieldMappings:
  - columnName: ProcessCommandLine
    identifier: CommandLine

ARM