Detection rules › Panther
Snowflake user with key-based auth logged in with password auth
Detect when a user that has key-based authentication configured logs in with a password
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation |
Rule body yaml
AnalysisType: scheduled_rule
Filename: snowflake_key_user_password_login.py
RuleID: "Snowflake.KeyUserPasswordLogin"
Description: >
Detect when a user that has key-based authentication configured logs in with a password
DisplayName: "Snowflake user with key-based auth logged in with password auth"
Enabled: false
ScheduledQueries:
- Query.Snowflake.KeyUserPasswordLogin
Tags:
- Snowflake
- Persistence:Account Manipulation
Reports:
MITRE ATT&CK:
- TA0003:T1098
Severity: Medium
Tests:
- Name: Key user logged in with Password
ExpectedResult: true
Log:
name: "testuser"
first_authentication_factor: "RSA_KEYPAIR"
Detection logic
Filter
def rule(_):
return True
def title(event):
return f"User {event.get('name')} logged in with Password instead of RSA key"
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field |
|---|
name |