Oracle suspicious command execution

Back


Id	e6c5ff42-0f42-4cec-994a-dabb92fe36e1
Rulename	Oracle suspicious command execution
Description	The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database.
Severity	Medium
Tactics	LateralMovement PrivilegeEscalation
Techniques	T1210 T1611
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OracleSuspiciousCommandExecution.yaml
Version	1.0.0
Arm template	e6c5ff42-0f42-4cec-994a-dabb92fe36e1.json

KQL

let timeframe= 1h;
DeviceProcessEvents
| where Timestamp >= ago(timeframe)
| where InitiatingProcessFileName =~ "oracle.exe"
| where not(FileName in~ ("conhost.exe", "oradim.exe"))
// Begin allow-list.
// End allow-list.

YAML

relevantTechniques:
- T1210
- T1611
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DeviceName
    identifier: FullName
- entityType: Account
  fieldMappings:
  - columnName: AccountSid
    identifier: Sid
  - columnName: AccountName
    identifier: Name
  - columnName: AccountDomain
    identifier: NTDomain
- entityType: Process
  fieldMappings:
  - columnName: ProcessCommandLine
    identifier: CommandLine
version: 1.0.0
id: e6c5ff42-0f42-4cec-994a-dabb92fe36e1
severity: Medium
kind: Scheduled
queryFrequency: 1h
description: |
    The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
triggerOperator: gt
name: Oracle suspicious command execution
tactics:
- LateralMovement
- PrivilegeEscalation
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/OracleSuspiciousCommandExecution.yaml
triggerThreshold: 0
queryPeriod: 1h
query: |
  let timeframe= 1h;
  DeviceProcessEvents
  | where Timestamp >= ago(timeframe)
  | where InitiatingProcessFileName =~ "oracle.exe"
  | where not(FileName in~ ("conhost.exe", "oradim.exe"))
  // Begin allow-list.
  // End allow-list.  
status: Available

ARM