Oracle suspicious command execution

Back


Id	e6c5ff42-0f42-4cec-994a-dabb92fe36e1
Rulename	Oracle suspicious command execution
Description	The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database.
Severity	Medium
Tactics	LateralMovement PrivilegeEscalation
Techniques	T1210 T1611
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OracleSuspiciousCommandExecution.yaml
Version	1.0.0
Arm template	e6c5ff42-0f42-4cec-994a-dabb92fe36e1.json

KQL

let timeframe= 1h;
DeviceProcessEvents
| where Timestamp >= ago(timeframe)
| where InitiatingProcessFileName =~ "oracle.exe"
| where not(FileName in~ ("conhost.exe", "oradim.exe"))
// Begin allow-list.
// End allow-list.

YAML

relevantTechniques:
- T1210
- T1611
entityMappings:
- fieldMappings:
  - columnName: DeviceName
    identifier: FullName
  entityType: Host
- fieldMappings:
  - columnName: AccountSid
    identifier: Sid
  - columnName: AccountName
    identifier: Name
  - columnName: AccountDomain
    identifier: NTDomain
  entityType: Account
- fieldMappings:
  - columnName: ProcessCommandLine
    identifier: CommandLine
  entityType: Process
triggerThreshold: 0
description: |
    The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
triggerOperator: gt
version: 1.0.0
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OracleSuspiciousCommandExecution.yaml
id: e6c5ff42-0f42-4cec-994a-dabb92fe36e1
queryFrequency: 1h
query: |
  let timeframe= 1h;
  DeviceProcessEvents
  | where Timestamp >= ago(timeframe)
  | where InitiatingProcessFileName =~ "oracle.exe"
  | where not(FileName in~ ("conhost.exe", "oradim.exe"))
  // Begin allow-list.
  // End allow-list.  
severity: Medium
status: Available
queryPeriod: 1h
name: Oracle suspicious command execution
tactics:
- LateralMovement
- PrivilegeEscalation
kind: Scheduled

ARM