Oracle DBMS_SCHEDULER OS Command Execution via UTL_FILE (Operation Escaneo)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects unauthorized execution of Oracle DBMS_SCHEDULER jobs combined with UTL_FILE output retrieval, a TTP observed in Operation Escaneo. The rule identifies suspicious command lines involving common database-layer exploitation scripts, manipulation of DBMS_SCHEDULER jobs, and interaction with the /tmp directory to exfiltrate or read command outputs.