Vendor: Oracle

July 25, 2023 · View on GitHub

Product: Oracle Database

RulesModelsMITRE TTPsEvent TypesParsers
6532877
Use-CaseEvent Types/ParsersMITRE TTPContent
Abnormal Authentication & Accessdatabase-access
s-oracle-db-login
cef-syslog-oracle-db-login
q-oracle-db-login
s-oracle-db-logon
oracle-db-login
s-oracle-db-login-1
oracle-db-login-1
s-oracle-db-activity-2
oracle-database-login

database-failed-login
q-oracle-db-query
s-oracle-db-query
s-oracle-db-select-1
oracle-db-query-1
cef-syslog-oracle-db-query
oracle-db-query-2
oracle-db-query-3
cef-oracle-db-query
oracle-db-query

database-login
oracle-db-login
s-oracle-db-login-1
oracle-db-login-1

database-query
cef-oracle-db-update
oracle-db-update

database-update
cef-oracle-db-delete
oracle-database-delete
siebel-db-query

failed-physical-access
oracle-db-access-1
oracle-db-access
s-oracle-db-activity-2
oracle-database-access-1

local-logon
s-oracle-db-execute-1
T1078 - Valid Accounts
T1078.003 - Valid Accounts: Local Accounts
  • 25 Rules
  • 10 Models
Brute Force Attackdatabase-access
s-oracle-db-login
cef-syslog-oracle-db-login
q-oracle-db-login
s-oracle-db-logon
oracle-db-login
s-oracle-db-login-1
oracle-db-login-1
s-oracle-db-activity-2
oracle-database-login

database-failed-login
q-oracle-db-query
s-oracle-db-query
s-oracle-db-select-1
oracle-db-query-1
cef-syslog-oracle-db-query
oracle-db-query-2
oracle-db-query-3
cef-oracle-db-query
oracle-db-query

database-login
oracle-db-login
s-oracle-db-login-1
oracle-db-login-1

database-query
cef-oracle-db-update
oracle-db-update

database-update
cef-oracle-db-delete
oracle-database-delete
siebel-db-query

failed-physical-access
oracle-db-access-1
oracle-db-access
s-oracle-db-activity-2
oracle-database-access-1

local-logon
s-oracle-db-execute-1
T1078 - Valid Accounts
  • 1 Rules
  • 1 Models
Next Page -->>

ATT&CK Matrix for Enterprise

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Valid Accounts

User Execution

Valid Accounts

Valid Accounts

Valid Accounts

Valid Accounts: Local Accounts

Steal or Forge Kerberos Tickets

Account Discovery

Remote Services

Remote Services: SMB/Windows Admin Shares

Data from Information Repositories