OracleDBAudit - New user account

Status: available
Severity: low
Time window: 14d
Source: github.com/Azure/Azure-Sentinel

'Detects when an action was made by new user.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1078` Valid Accounts
Persistence	`T1078` Valid Accounts

Rule body

id: cca7b348-e904-4a7a-8f26-d22d4d477119
name: OracleDBAudit - New user account
description: |
  'Detects when an action was made by new user.'
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 3h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
relevantTechniques:
  - T1078
query: |
  let lbtime_d = 14d;
  let lbtime_24h = 24h;
  let known_users = OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | summarize makeset(DstUserName);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | where DstUserName !in (known_users)
  | project DstUserName
  | extend AccountCustomEntity = DstUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let lbtime_d = 14d;
let lbtime_24h = 24h;

Let binding: `known_users` used in Stage 4

let known_users = OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_d) .. ago(lbtime_24h))
| where isnotempty(DstUserName)
| where isnotempty(Action)
| summarize makeset(DstUserName);

Stage 1: `source`

OracleDatabaseAuditEvent

Stage 2: `where`

| where isnotempty(DstUserName)

Stage 3: `where`

| where isnotempty(Action)

Stage 4: `where`

| where DstUserName !in (known_users)

Stage 5: `project`

| project DstUserName

Stage 6: `extend`

| extend AccountCustomEntity = DstUserName

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`DstUserName`	eq	`known_users`	`excludes:DstUserName` `field:"DstUserName" value:"known_users"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	is_not_null	(no value, null check)	`field:"Action" kind:is_not_null`
`DstUserName`	is_not_null	(no value, null check)	`field:"DstUserName" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`DstUserName`	`project`
`AccountCustomEntity`	`extend`

OracleDBAudit - New user account

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Parameters

Let binding: known_users used in Stage 4

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: where

Stage 5: project

Stage 6: extend

Exclusions

Indicators

Output fields

Let binding: `known_users` used in Stage 4

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `where`

Stage 5: `project`

Stage 6: `extend`