Snowflake Data Exfiltration

Description

Detects multi-step Snowflake data exfiltration by identifying temporary stage creation, table data copied to stage, and file downloads. This technique was used in the April 2024 Snowflake breach (UNC5537) targeting accounts without MFA. The correlation of all three steps provides high-confidence evidence of active data theft beyond legitimate ETL operations.

Query

Detection:
  - Group:
      - ID: SnowflakeTempStageCreated
        RuleID: Snowflake.Stream.TempStageCreated
      - ID: SnowflakeCopyIntoStage
        RuleID: Snowflake.Stream.TableCopiedIntoStage
      - ID: SnowflakeFileDownloaded
        RuleID: Snowflake.Stream.FileDownloaded
    MatchCriteria:
      field_name:
        - GroupID: SnowflakeTempStageCreated
          Match: p_alert_context.stage
        - GroupID: SnowflakeCopyIntoStage
          Match: p_alert_context.stage
        - GroupID: SnowflakeFileDownloaded
          Match: p_alert_context.stage
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 15
    LookbackWindowMinutes: 1800

Rule dependencies

⚠ Higher-order rule. It fires on other rules' alerts, not on raw events, so it cannot fire on its own. Deploy the rules it depends on too.

Depends on

Analyst notes

  1. Query Snowflake's QUERY_HISTORY and ACCESS_HISTORY views for the stage name in p_alert_context.stage to identify the user account, session ID, source IP addresses, client application, and all tables that were copied into the stage
  2. Review the specific tables copied into the stage to determine data sensitivity (PII, financial records, intellectual property) and estimate the volume of data exfiltrated, then check Snowflake's LOGIN_HISTORY to verify if the user account had MFA enabled
  3. Analyze the source IP addresses used during the exfiltration sequence against threat intelligence feeds to determine if they are corporate IPs, suspicious cloud providers, or known malicious infrastructure, and check for impossible travel patterns
Raw source Snowflake Data Exfiltration · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: correlation_rule
RuleID: "Snowflake.Stream.DataExfiltration.Group"
DisplayName: "Snowflake Data Exfiltration"
Enabled: false
Tags:
  - Snowflake
  - Data Exfiltration
  - Database
  - Cloud Security
Severity: Critical
Description: >
  Detects multi-step Snowflake data exfiltration by identifying temporary stage creation, table data copied to stage, and file downloads. This technique was used in the April 2024 Snowflake breach (UNC5537) targeting accounts without MFA. The correlation of all three steps provides high-confidence evidence of active data theft beyond legitimate ETL operations.
Runbook: |
  1. Query Snowflake's QUERY_HISTORY and ACCESS_HISTORY views for the stage name in p_alert_context.stage to identify the user account, session ID, source IP addresses, client application, and all tables that were copied into the stage
  2. Review the specific tables copied into the stage to determine data sensitivity (PII, financial records, intellectual property) and estimate the volume of data exfiltrated, then check Snowflake's LOGIN_HISTORY to verify if the user account had MFA enabled
  3. Analyze the source IP addresses used during the exfiltration sequence against threat intelligence feeds to determine if they are corporate IPs, suspicious cloud providers, or known malicious infrastructure, and check for impossible travel patterns
Reference: https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion/
Reports:
  MITRE ATT&CK:
    - TA0010:T1041 # Exfiltration: Exfiltration Over C2 Channel
    - TA0010:T1530 # Exfiltration: Data from Cloud Storage
    - TA0009:T1213 # Collection: Data from Information Repositories
Detection:
  - Group:
      - ID: SnowflakeTempStageCreated
        RuleID: Snowflake.Stream.TempStageCreated
      - ID: SnowflakeCopyIntoStage
        RuleID: Snowflake.Stream.TableCopiedIntoStage
      - ID: SnowflakeFileDownloaded
        RuleID: Snowflake.Stream.FileDownloaded
    MatchCriteria:
      field_name:
        - GroupID: SnowflakeTempStageCreated
          Match: p_alert_context.stage
        - GroupID: SnowflakeCopyIntoStage
          Match: p_alert_context.stage
        - GroupID: SnowflakeFileDownloaded
          Match: p_alert_context.stage
    Schedule:
      RateMinutes: 1440
      TimeoutMinutes: 15
    LookbackWindowMinutes: 1800
Tests:
    - Name: Data Exfiltration
      ExpectedResult: true
      RuleOutputs:
        - ID: SnowflakeTempStageCreated
          Matches:
            p_alert_context.stage:
                LOGS.PUBLIC.data_exfil:
                    - "2006-01-02T15:04:05Z"
                    - "2006-01-02T15:04:06Z"
        - ID: SnowflakeCopyIntoStage
          Matches:
            p_alert_context.stage:
                LOGS.PUBLIC.data_exfil:
                    - "2006-01-02T15:04:05Z"
                    - "2006-01-02T15:04:06Z"
        - ID: SnowflakeFileDownloaded
          Matches:
            p_alert_context.stage:
                LOGS.PUBLIC.data_exfil:
                    - "2006-01-02T15:04:05Z"
                    - "2006-01-02T15:04:06Z"
    - Name: Data Staged but not Downloaded
      ExpectedResult: false
      RuleOutputs:
        - ID: SnowflakeTempStageCreated
          Matches:
            p_alert_context.stage:
                LOGS.PUBLIC.data_exfil:
                    - "2006-01-02T15:04:05Z"
                    - "2006-01-02T15:04:06Z"
        - ID: SnowflakeCopyIntoStage
          Matches:
            p_alert_context.stage:
                LOGS.PUBLIC.data_exfil:
                    - "2006-01-02T15:04:05Z"
                    - "2006-01-02T15:04:06Z"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.