Snowflake Password Spray

Description

Detects password spraying attacks against Snowflake by tracking the number of distinct user accounts targeted by failed login attempts from the same source IP address within a short timeframe. Unlike brute force against a single account, password spraying distributes attempts across many accounts to evade lockout policies. This rule complements Snowflake.Stream.BruteForceByIp (same IP, any accounts) and Snowflake.PotentialBruteForceSuccess.Group (brute force followed by confirmed login).

Query · python

def rule(event):
    return (
        event.get("EVENT_TYPE") == "LOGIN"
        and event.get("IS_SUCCESS") == "NO"
        and event.get("ERROR_MESSAGE") != "OVERFLOW_FAILURE_EVENTS_ELIDED"
    )


def unique(event):
    return event.get("USER_NAME", "UNKNOWN_USER")


def dedup(event):
    return event.get("CLIENT_IP", "UNKNOWN_IP")


def title(event):
    client_ip = event.get("CLIENT_IP", "UNKNOWN_IP")
    return f"[Snowflake] Password spray detected from IP [{client_ip}] targeting multiple accounts"


def severity(event):
    # Downgrade JWT key mismatches to INFO as these are typically automation misconfiguration
    if event.get("ERROR_MESSAGE") == "JWT_TOKEN_INVALID_PUBLIC_KEY_FINGERPRINT_MISMATCH":
        return "INFO"
    return "DEFAULT"


def alert_context(event):
    return {
        "client_ip": event.get("CLIENT_IP", "UNKNOWN_IP"),
        "user_name": event.get("USER_NAME", "UNKNOWN_USER"),
        "client_type": event.get("REPORTED_CLIENT_TYPE"),
        "error_code": event.get("ERROR_CODE"),
        "error_message": event.get("ERROR_MESSAGE"),
    }

Analyst notes

Review the distinct usernames targeted from the source IP and determine if any are privileged accounts (ACCOUNTADMIN, SYSADMIN, SECURITYADMIN) which would elevate the risk significantly
Query Snowflake LoginHistory for all events with IS_SUCCESS = 'YES' from the same CLIENT_IP within the past 60 minutes to determine if any spray attempt succeeded — the alert context shows only the last triggering username, not all targeted accounts
Check if the source IP belongs to known anonymization infrastructure (VPNs, Tor exit nodes, cloud provider ranges) and cross-reference against other Snowflake tenants if applicable

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Medium
Status: Stable
Query type: python
Created: 2026-04-20
Modified: 2026-06-17
Authored by: panther-labs
Source ID
Upstream: rules/snowflake_rules/snowflake_stream_password_spray.yml
Type: rule
Version: 2
References: https://docs.snowflake.com/en/sql-reference/account-usage/login_history
Data sources: Snowflake.LoginHistory

ATT&CK

TA0006 T1110.003