Detection rules › Kusto
Oracle - Put file and get file from same IP address
'Detects put or get files from one source in short timeframe'
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule body
id: 033e98d2-5740-11ec-bf63-0242ac130002
name: Oracle - Put file and get file from same IP address
description: |
'Detects put or get files from one source in short timeframe'
severity: Medium
status: Available
requiredDataConnectors:
- connectorId: CustomLogsAma
dataTypes:
- OracleWebLogicServer_CL
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
- InitialAccess
relevantTechniques:
- T1190
- T1133
query: |
let p = OracleWebLogicServerEvent
| where HttpRequestMethod in~ ('POST', 'PUT')
| sort by EventStartTime asc
| summarize post_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal);
OracleWebLogicServerEvent
| where HttpRequestMethod =~ 'GET'
| sort by EventStartTime asc
| summarize get_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal)
| join kind=innerunique (p) on UrlOriginal, SrcIpAddr
| extend second = datetime_diff('second',get_time,post_time)
| where second between (1 .. 300)
| project second, post_time, get_time, SrcIpAddr, UrlOriginal
| extend IPCustomEntity = SrcIpAddr, UrlCustomEntity = tostring(UrlOriginal)
entityMappings:
- entityType: IP
fieldMappings:
- identifier: Address
columnName: IPCustomEntity
- entityType: URL
fieldMappings:
- identifier: Url
columnName: UrlCustomEntity
version: 1.0.2
kind: Scheduled
Stages and Predicates
Let binding: p
let p = OracleWebLogicServerEvent
| where HttpRequestMethod in~ ('POST', 'PUT')
| sort by EventStartTime asc
| summarize post_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal);
Stage 1: source
OracleWebLogicServerEvent
Stage 2: where
| where HttpRequestMethod =~ 'GET'
Stage 3: sort
| sort by EventStartTime asc
Stage 4: summarize
| summarize get_time=min(EventStartTime) by SrcIpAddr, tostring(UrlOriginal)
Stage 5: join
| join kind=innerunique (p) on UrlOriginal, SrcIpAddr
Stage 6: extend
| extend second = datetime_diff('second',get_time,post_time)
Stage 7: where
| where second between (1 .. 300)
Stage 8: project
| project second, post_time, get_time, SrcIpAddr, UrlOriginal
Stage 9: extend
| extend IPCustomEntity = SrcIpAddr, UrlCustomEntity = tostring(UrlOriginal)
Indicators
These rows show field, operator, and value matches.
Output fields
These fields are emitted when the rule matches.
| Field | Source |
|---|---|
SrcIpAddr | project |
UrlOriginal | project |
get_time | project |
post_time | project |
second | project |
IPCustomEntity | extend |
UrlCustomEntity | extend |