Oracle E-Business Suite Under Active Attack: CISA Emergency Directive & Response Guide

---
title: Potential Oracle EBS Web Shell Activity
id: 8c2f4a1d-9e3a-4b1c-8f7d-2a5b6c9d0e1f
status: experimental
description: Detects suspicious process execution spawned by Oracle EBS web tier processes (httpd, java, weblogic). Often indicates successful RCE or web shell upload.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/05/16
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'httpd'
      - 'java'
      - 'weblogic'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative debugging by authorized staff
level: critical
---
title: Suspicious File Access in Oracle EBS Directories
id: 1d4e6f8a-3b2c-4a5d-9e8f-1a2b3c4d5e6f
status: experimental
description: Detects access or modification of sensitive Oracle EBS configuration or script directories by the web user.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/05/16
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_access
  product: linux
detection:
  selection:
    TargetFilename|contains:
      - '/OA_HTML/'
      - '/OA_JSP/'
      - '/OA_MEDIA/'
    Image|contains:
      - 'httpd'
      - 'java'
  filter_legit:
    TargetFilename|endswith:
      - '.class'
      - '.jsp'
      - '.js'
      - '.css'
  condition: selection and not filter_legit
falsepositives:
  - Rare; usually indicates patching or legitimate dev work
level: high

// Hunt for unusual child processes spawned by Oracle EBS web services
DeviceProcessEvents
| where Timestamp > ago(1d)
| where ParentProcessName in ("httpd", "java", "weblogic.Server", "Tuxedo")
| where ProcessName in ("sh", "bash", "perl", "python", "nc", "curl", "wget")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for processes where the parent is an Oracle web server but the child is a system shell
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Ppid in (SELECT Pid FROM pslist() WHERE Name =~ 'httpd' OR Name =~ 'java')
  AND (Name =~ 'sh' OR Name =~ 'bash' OR Name =~ 'curl')

#!/bin/bash
# Script to check Oracle EBS Techstack Patch Level
# Run as the 'oracle' user or root with appropriate environment sourcing

echo "[+] Checking Oracle E-Business Suite Patch Status..."

# Define standard EBS environment paths (Adjust as per your environment)
# COMMON_TOP=/u01/install/APPS/EBS/fs1/EBSapps/appl
# ADMIN_SCRIPTS_HOME=$COMMON_TOP/admin/scripts

# Check if OPatch utility is available
if ! command -v opatch &> /dev/null
then
    echo "[!] OPatch utility not found in PATH. Please source the EBS environment file."
    echo "[!] Attempting to find OPatch in common Oracle locations..."
    find /u01 -name "opatch" -type f 2>/dev/null | head -n 5
    exit 1
fi

# Check applied patches for the EBS Oracle Home
# Note: Replace ORACLE_HOME with your actual EBS Oracle Home path
ORACLE_HOME=${ORACLE_HOME:-"/u01/install/APPS/EBS/fs1/FMW_Home/webtier"}

echo "[*] Analyzing patches in Oracle Home: $ORACLE_HOME"

# List recently applied patches (last 30 days)
# We look for the specific Critical Patch Update (CPU) pattern or recent activity
opatch lsinventory -details | grep -A 5 "Patch description" | tail -n 20

echo "[+] Action Required:"
echo "    1. Compare the output above with the security patch ID listed in the CISA Alert."
echo "    2. If the patch is missing, apply the emergency patch immediately."
echo "    3. Restart the Oracle HTTP Server and OACore services."