detection.wiki

Detection rules › Panther

Snowflake Account Admin Granted

Severity
medium
Tags
Snowflake, Privilege Escalation:Valid Accounts
Source
github.com/panther-labs/panther-analysis

Detect when account admin is granted.

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationT1078 Valid Accounts

Rule body yaml

AnalysisType: scheduled_rule
Filename: snowflake_account_admin_assigned.py
RuleID: "Snowflake.AccountAdminGranted"
Description: >
  Detect when account admin is granted.
DisplayName: "Snowflake Account Admin Granted"
Enabled: false
Tags:
  - Snowflake
  - Privilege Escalation:Valid Accounts
Reports:
  MITRE ATT&CK:
    - TA0004:T1078
ScheduledQueries:
  - Query.Snowflake.AccountAdminGranted
Severity: Medium
Tests:
  - Name: Value Returned By Query
    ExpectedResult: true
    Log:
      query_text: "grant role accountadmin to user testuser;"

Detection logic

Filter

def rule(_):
    return True


def title(event):
    target = " ".join(event.get("query_text", "").split(" ")[-2:])
    return f"Snowflake AccountAdmin granted to {target}"