Suspicious query

Hello,

We identified the query below coming from a session of the application server, the user owner of the application, I would like to know if it is a normal query or could be a possible attack attempt.

could you help me please?

SELECT /*+ CONNECT_BY_FILTERING */ s.privilege# FROM sys.sysauth$ s

CONNECT BY s.grantee# = PRIOR s.privilege#

AND (s.privilege# > 0 OR s.privilege# = -352)

START WITH (s.privilege# > 0 OR s.privilege# = -352) AND s.grantee# IN

(SELECT c1.privilege# FROM sys.codeauth$ c1 WHERE c1.obj# = :1)  UNION                                                                    

SELECT c2.privilege# FROM sys.codeauth$ c2 WHERE c2.obj# = :2