Searching extended audit using case insensitive search
An IDS evading attack:
SQL> SELECT paSsWOrd, username from DBA_USERS where username = (chr(83)|| chr(89)||chr(83));
PASSWORD USERNAME
—————————— ——————————
0C15939594CE60D2 SYS
DB Extended audit will record the text of the attack in the extra column called SQLTEXT which is a CLOB.
This is a query that can be used to search it in a case agnostic manner.
select auditid, sqltext from sys.aud$ where TO_CHAR(upper(sqltext)) like ‘%PASSWORD%’;
