detection.wiki

Detection rules › Panther

Snowflake Brute Force Attacks by Username

Severity
medium
Tags
Snowflake, Credential Access:Brute Force
Source
github.com/panther-labs/panther-analysis

Detect brute force attacks by monitoring for failed logins by the same username

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1110 Brute Force

Rule body yaml

AnalysisType: scheduled_rule
Filename: snowflake_brute_force_username.py
RuleID: "Snowflake.BruteForceByUsername"
Description: >
  Detect brute force attacks by monitoring for failed logins by the same username
DisplayName: "Snowflake Brute Force Attacks by Username"
Enabled: false
ScheduledQueries:
  - Query.Snowflake.FailedLogins
Tags:
  - Snowflake
  - Credential Access:Brute Force
Reports:
  MITRE ATT&CK:
    - TA0006:T1110
Severity: Medium
Threshold: 5
SummaryAttributes:
  - client_ip
  - error_message
  - error_code
  - reported_client_type
Tests:
  - Name: Value Returned By Query
    ExpectedResult: true
    Log:
      user_name: "testuser"
      error_message: JWT_TOKEN_INVALID_PUBLIC_KEY_FINGERPRINT_MISMATCH
      count_by_username: 100
  - Name: Common Error Message
    ExpectedResult: true
    Log:
      user_name: "testuser"
      count_by_username: 100

Detection logic

Filter

def rule(_):
    return True
def title(event):
    return (
        f"Snowflake: {event.get('counts_by_user', 'many')} failed login attempts by user "
        f"[{event.get('user_name','<UNKNOWN_USER>')}]"
    )
def severity(event):
    common_errors = {"JWT_TOKEN_INVALID_PUBLIC_KEY_FINGERPRINT_MISMATCH"}
    if event.get("ERROR_MESSAGE") in common_errors:
        return "INFO"
    return "DEFAULT"
def dedup(event):
    return f"[{severity(event)}] {title(event)}"

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
counts_by_user
user_name