Classification:

attack

Tactic:

TA0040-impact

Technique:

T1485-data-destruction

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect repeated failed resource deletion attempts within an Oracle Fusion application, which may indicate a compromised account probing for destructive actions, a misconfigured automation job, or a user attempting unauthorized bulk changes.

Strategy

This rule monitors Oracle Fusion audit logs (source:oracle-fusion and service:oracle-fusion-audit) for ResourceDeletion events that are not marked successful. It triggers a Medium severity signal when a single user account performs more than 50 failed resource deletion attempts within a 5-minute window. This pattern indicates abnormal bulk deletion activity.

Triage and Response

1. Identify the user {{@usr.id}} responsible for the deletion activity and determine whether the volume is consistent with legitimate business operations.
2. Review what resources were targeted for deletion and assess the potential business impact.
3. Determine why the deletion attempts are failing (permissions or policy issues, missing prerequisites, automation errors) and whether any successful deletions occurred around the same time.
4. If the activity is unauthorized, disable the account immediately and preserve audit logs for forensic review.
5. Escalate to your incident response process and initiate data recovery procedures if necessary.