Oracle DBMS_SCHEDULER and UTL_FILE OS Command Execution and Exfiltration
This rule detects suspicious activity on Oracle database hosts, including the spawning of unexpected child processes from Oracle service binaries (such as cmd.exe or shells), the creation or access of known exploit-related script filenames, and the use of UTL_FILE to write files with suspicious extensions to temporary directories, which are patterns indicative of exploitation attempts like DBMS_SCHEDULER remote code execution or data exfiltration.
Microsoft Sentinel (KQL)
