detection.wiki

Detection rules › Kusto

OracleDBAudit - User activity after long inactivity time

Status
available
Severity
medium
Time window
14d
Source
github.com/Azure/Azure-Sentinel

'Detects when an action was made by a user which last activity was observed more than 30 days ago.'

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Persistence

Rule body

id: 5e93a535-036b-4570-9e58-d8992f30e1ae
name: OracleDBAudit - User activity after long inactivity time
description: |
  'Detects when an action was made by a user which last activity was observed more than 30 days ago.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 14d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
  - Persistence
relevantTechniques:
  - T1078
query: |
  let lbtime_14d = 14d;
  let lbtime_7d = 7d;
  let lbtime_24h = 24h;
  let known_users_14d = OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_14d) .. ago(lbtime_14d))
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | summarize makeset(DstUserName);
  let known_users_7d = OracleDatabaseAuditEvent
  | where TimeGenerated between (ago(lbtime_7d) .. ago(lbtime_24h))
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | summarize makeset(DstUserName);
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where isnotempty(Action)
  | where DstUserName !in (known_users_7d)
  | where DstUserName in (known_users_14d)
  | project DstUserName
  | extend AccountCustomEntity = DstUserName
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Parameters

let lbtime_14d = 14d;
let lbtime_7d = 7d;
let lbtime_24h = 24h;

Let binding: known_users_14d used in Stage 5

let known_users_14d = OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_14d) .. ago(lbtime_14d))
| where isnotempty(DstUserName)
| where isnotempty(Action)
| summarize makeset(DstUserName);

Let binding: known_users_7d used in Stage 4

let known_users_7d = OracleDatabaseAuditEvent
| where TimeGenerated between (ago(lbtime_7d) .. ago(lbtime_24h))
| where isnotempty(DstUserName)
| where isnotempty(Action)
| summarize makeset(DstUserName);

Stage 1: source

OracleDatabaseAuditEvent

Stage 2: where

| where isnotempty(DstUserName)

Stage 3: where

| where isnotempty(Action)

Stage 4: where

| where DstUserName !in (known_users_7d)

Stage 5: where

| where DstUserName in (known_users_14d)

Stage 6: project

| project DstUserName

Stage 7: extend

| extend AccountCustomEntity = DstUserName

Exclusions

The rule actively suppresses these predicates.

FieldKindExcluded valuesSearch
DstUserNameeqknown_users_7dexcludes:DstUserName field:"DstUserName" value:"known_users_7d"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
Actionis_not_null
  • (no value, null check)
field:"Action" kind:is_not_null
DstUserNamein
  • known_users_14d
field:"DstUserName" kind:in value:"known_users_14d"
DstUserNameis_not_null
  • (no value, null check)
field:"DstUserName" kind:is_not_null

Output fields

These fields are emitted when the rule matches.

FieldSource
DstUserNameproject
AccountCustomEntityextend