MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Exfiltration | T1041 Exfiltration Over C2 Channel |
Rule body yaml
AnalysisType: rule
Filename: snowflake_stream_temp_stage_created.py
RuleID: Snowflake.Stream.TempStageCreated
DisplayName: Snowflake Temporary Stage Created
Enabled: true
LogTypes:
- Snowflake.QueryHistory
Severity: Info
CreateAlert: false
Reports:
MITRE ATT&CK:
- TA0010:T1041 # Exfiltration Over C2 Channel
Description: A temporary stage was created.
Reference:
https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion/
Tags:
- Snowflake
- '[MITRE] Exfiltration'
- '[MITRE] Exfiltration Over C2 Channel'
Tests:
- Name: Successful Temp Stage Created
ExpectedResult: true
Log:
{
"p_event_time": "2024-10-09 21:06:03.631000000",
"p_log_type": "Snowflake.QueryHistory",
"p_source_id": "132d65cd-d6e4-4981-a209-a1d5902afd59",
"p_source_label": "SF-Ben",
"EXECUTION_STATUS": "SUCCESS",
"QUERY_TEXT": "CREATE OR REPLACE TEMP STAGE panther_logs.PUBLIC.data_exfil;",
"QUERY_TYPE": "CREATE",
"USER_NAME": "LEX_LUTHOR",
"WAREHOUSE_NAME": "ADMIN_WH"
}
- Name: Successful Temp Stage Created or Replaced
ExpectedResult: true
Log:
{
"p_event_time": "2024-10-09 21:06:03.631000000",
"p_log_type": "Snowflake.QueryHistory",
"p_source_id": "132d65cd-d6e4-4981-a209-a1d5902afd59",
"p_source_label": "SF-Ben",
"EXECUTION_STATUS": "SUCCESS",
"QUERY_TEXT": "CREATE OR REPLACE TEMP STAGE my_temp_stage;",
"QUERY_TYPE": "CREATE",
"USER_NAME": "LEX_LUTHOR",
"WAREHOUSE_NAME": "ADMIN_WH"
}
- Name: Unsuccessful Temp Stage Created
ExpectedResult: false
Log:
{
"p_event_time": "2024-10-09 21:06:03.631000000",
"p_log_type": "Snowflake.QueryHistory",
"p_source_id": "132d65cd-d6e4-4981-a209-a1d5902afd59",
"p_source_label": "SF-Ben",
"EXECUTION_STATUS": "FAIL",
"QUERY_TEXT": "CREATE TEMP STAGE my_temp_stage;",
"QUERY_TYPE": "CREATE",
"USER_NAME": "LEX_LUTHOR",
"WAREHOUSE_NAME": "ADMIN_WH"
}
Detection logic
Condition
QUERY_TYPE eq "CREATE"
EXECUTION_STATUS eq "SUCCESS"
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EXECUTION_STATUS | eq |
|
QUERY_TYPE | eq |
|