Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

step3

-- 1. Declare the bind variable where the results will be stored. -- The name of the cursor variable is ':p_result' VAR p_result REFCURSOR; DECLARE -- Define a custom type to hold the result row structure TYPE t_table_stats IS…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

-- 1. Declare the bind variable where the results will be stored.
-- The name of the cursor variable is ':p_result'
VAR p_result REFCURSOR;

DECLARE
-- Define a custom type to hold the result row structure
TYPE t_table_stats IS RECORD (
table_name_col VARCHAR2(40),
rows_last_45_days NUMBER,
total_rows_approx NUMBER,
percentage_change NUMBER
);

-- Define a collection type to hold all results
TYPE t_table_stats_tab IS TABLE OF t_table_stats INDEX BY PLS_INTEGER;
l_results t_table_stats_tab;

v_idx PLS_INTEGER := 0;

BEGIN
-- Loop through the tables that meet the criteria
FOR r IN (
SELECT table_name
FROM user_tab_columns
WHERE column_name = 'INTERNTIMESTAMP'
AND data_type LIKE 'TIMESTAMP%'
ORDER BY table_name
)
LOOP
DECLARE
v_cnt NUMBER := 0;
v_total NUMBER := 0;
BEGIN
-- Execute dynamic SQL to count rows in the last 45 days
EXECUTE IMMEDIATE
'SELECT COUNT(*) FROM "' || r.table_name ||
'" WHERE INTERNTIMESTAMP >= SYSDATE - 45'
INTO v_cnt;

-- Get total rows from statistics
SELECT num_rows INTO v_total
FROM user_tables
WHERE table_name = r.table_name;

v_idx := v_idx + 1;

-- Store the results in the collection
l_results(v_idx).table_name_col := r.table_name;
l_results(v_idx).rows_last_45_days := v_cnt;
l_results(v_idx).total_rows_approx := NVL(v_total, 0);
l_results(v_idx).percentage_change := ROUND(v_cnt / GREATEST(v_total, 1) * 100, 2);

EXCEPTION
WHEN OTHERS THEN
-- If an error occurs, log the error row instead of the data
v_idx := v_idx + 1;
l_results(v_idx).table_name_col := r.table_name || ' → ERROR: ' || SQLERRM;
l_results(v_idx).rows_last_45_days := NULL;
l_results(v_idx).total_rows_approx := NULL;
l_results(v_idx).percentage_change := NULL;
END;
END LOOP;

-- Open the REF CURSOR to the content of the collection.
-- This uses the standard SQL function TABLE() to convert the PL/SQL collection
-- into a selectable result set.
OPEN :p_result FOR
SELECT
t.table_name_col AS TABLE_NAME,
t.rows_last_45_days AS ROWS_LAST_45_DAYS,
t.total_rows_approx AS TOTAL_ROWS_APPROX,
t.percentage_change AS PCT
FROM TABLE(CAST(l_results AS t_table_stats_tab)) t;

END;
/
-- The "PRINT" command is a SQL*Plus/SQL Developer command,
-- but the use of the bind variable ':p_result' is usually enough
-- for DbVisualizer to detect the output and display it.
-- You may need to run this SELECT in a separate statement if DbVisualizer
-- doesn't automatically show the cursor result:
-- SELECT * FROM TABLE(:p_result);


1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - step3
id: 8c31ab3e-153c-4ee8-9f0d-fa9df169ee25
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "step3" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("step3")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*step3*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "step3"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich step3.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten step3

Thematisch verwandte Begriffe: step3 · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97898 | Insecure Direct Object Reference / missing object-level authorization in…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag