Oracle suspicious command execution

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database.

MITRE ATT&CK coverage

Tactic	Techniques
Privilege Escalation	`T1611` Escape to Host
Lateral Movement	`T1210` Exploitation of Remote Services

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

id: e6c5ff42-0f42-4cec-994a-dabb92fe36e1
name: Oracle suspicious command execution
description: |
  The query searches process creation events that are indicative of an attacker spawning OS commands from an Oracle database.
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - LateralMovement
  - PrivilegeEscalation
relevantTechniques:
  - T1210
  - T1611
query: |
  let timeframe= 1h;
  DeviceProcessEvents
  | where Timestamp >= ago(timeframe)
  | where InitiatingProcessFileName =~ "oracle.exe"
  | where not(FileName in~ ("conhost.exe", "oradim.exe"))
  // Begin allow-list.
  // End allow-list.
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: DeviceName
  - entityType: Account
    fieldMappings:
      - identifier: Sid
        columnName: AccountSid
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountDomain
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: ProcessCommandLine
version: 1.0.0
kind: Scheduled

Stages and Predicates

Parameters

let timeframe = 1h;

Stage 1: `source`

DeviceProcessEvents

Stage 2: `where`

| where Timestamp >= ago(timeframe)

Stage 3: `where`

| where InitiatingProcessFileName =~ "oracle.exe"

Stage 4: `where`

| where not(FileName in~ ("conhost.exe", "oradim.exe"))

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`FileName`	in	`conhost.exe`, `oradim.exe`	`excludes:FileName` `field:"FileName" value:"conhost.exe"` `field:"FileName" value:"oradim.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`InitiatingProcessFileName`	eq	`oracle.exe`	`field:"parent_process_name" kind:eq value:"oracle.exe"`