MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration | T1041 Exfiltration Over C2 Channel |
Rule body yaml
AnalysisType: rule
Filename: snowflake_stream_table_copied_into_stage.py
RuleID: Snowflake.Stream.TableCopiedIntoStage
DisplayName: Snowflake Table Copied Into Stage
Enabled: true
LogTypes:
- Snowflake.QueryHistory
Severity: Info
CreateAlert: false
Reports:
MITRE ATT&CK:
- TA0010:T1041 # Exfiltration Over C2 Channel
Description: A table was copied into a stage.
Reference:
https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion/
Tags:
- Snowflake
- '[MITRE] Exfiltration'
- '[MITRE] Exfiltration Over C2 Channel'
Tests:
- Name: Copy from Table into Stage
ExpectedResult: true
Log:
{
"EXECUTION_STATUS": "SUCCESS",
"QUERY_TEXT": "COPY INTO '@PANTHER_LOGS.PUBLIC.data_exfil/DATA.csv'
FROM (SELECT * FROM PANTHER_LOGS.PUBLIC.amazon_eks_audit LIMIT 100)
FILE_FORMAT = (
TYPE='CSV'
COMPRESSION=GZIP
FIELD_DELIMITER=','
ESCAPE=NONE
ESCAPE_UNENCLOSED_FIELD=NONE
date_format='AUTO'
time_format='AUTO'
timestamp_format='AUTO'
binary_format='UTF-8'
null_if=''
EMPTY_FIELD_AS_NULL = FALSE
)
overwrite=TRUE
single=FALSE
max_file_size=5368709120
header=TRUE",
"QUERY_TYPE": "UNLOAD",
"USER_NAME": "LEX_LUTHOR"
}
- Name: Copy from Stage into Table
ExpectedResult: false
Log:
{
"EXECUTION_STATUS": "SUCCESS",
"QUERY_TEXT": "COPY INTO mytable\nFROM @mystage/result/data_ FILE_FORMAT =
(FORMAT_NAME='CSV' COMPRESSION='GZIP');",
"QUERY_TYPE": "UNLOAD",
"USER_NAME": "LEX_LUTHOR"
}
Detection logic
Condition
QUERY_TYPE eq "UNLOAD"
EXECUTION_STATUS eq "SUCCESS"
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EXECUTION_STATUS | eq |
|
QUERY_TYPE | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
actor | USER_NAME |