OracleDBAudit - SQL injection patterns

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'Detects common known SQL injection patterns used in automated scripts.'

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

id: ab352f0d-7c55-4ab2-a22e-b1c2d995e193
name: OracleDBAudit - SQL injection patterns
description: |
  'Detects common known SQL injection patterns used in automated scripts.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: SyslogAma
    datatypes:
      - Syslog
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
query: |
  OracleDatabaseAuditEvent
  | where isnotempty(DstUserName)
  | where Action has_any ("admin' --" ,"admin' #", "admin'/*", "0=1", "1=0", "1=1", "1=2", "' or 1=1--", "' or 1=1#", "' or 1=1/*", "') or '1'='1--", "') or ('1'='1--")
  | project SrcIpAddr, DstUserName, Action
  | extend AccountCustomEntity = DstUserName
  | extend IPCustomEntity = SrcIpAddr
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: AccountCustomEntity
  - entityType: IP
    fieldMappings:
      - identifier: Address
        columnName: IPCustomEntity
version: 1.0.2
kind: Scheduled

Stages and Predicates

Stage 1: `source`

OracleDatabaseAuditEvent

Stage 2: `where`

| where isnotempty(DstUserName)

Stage 3: `where`

| where Action has_any ("admin' --" ,"admin' #", "admin'/*", "0=1", "1=0", "1=1", "1=2", "' or 1=1--", "' or 1=1#", "' or 1=1/*", "') or '1'='1--", "') or ('1'='1--")

Stage 4: `project`

| project SrcIpAddr, DstUserName, Action

Stage 5: `extend`

| extend AccountCustomEntity = DstUserName

Stage 6: `extend`

| extend IPCustomEntity = SrcIpAddr

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Action`	match	`' or 1=1#` transforms: `term` `' or 1=1--` transforms: `term` `' or 1=1/` transforms: `term` `') or '1'='1--` transforms: `term` `') or ('1'='1--` transforms: `term` `0=1` transforms: `term` `1=0` transforms: `term` `1=1` transforms: `term` `1=2` transforms: `term` `admin' #` transforms: `term` `admin' --` transforms: `term` `admin'/` transforms: `term`	`field:"Action" kind:match`
`DstUserName`	is_not_null	(no value, null check)	`field:"DstUserName" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Action`	`project`
`DstUserName`	`project`
`SrcIpAddr`	`project`
`AccountCustomEntity`	`extend`
`IPCustomEntity`	`extend`

OracleDBAudit - SQL injection patterns

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: project

Stage 5: extend

Stage 6: extend

Indicators

Output fields

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `project`

Stage 5: `extend`

Stage 6: `extend`