MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1136 Create Account |
Rule body yaml
AnalysisType: rule
Filename: snowflake_stream_user_created.py
RuleID: Snowflake.Stream.UserCreated
DisplayName: Snowflake User Created
Enabled: false
LogTypes:
- Snowflake.QueryHistory
Severity: Info
Reports:
MITRE ATT&CK:
- TA0003:T1136
Description: Detect new users created in Snowflake.
Tags:
- Snowflake
- '[MITRE] Persistence'
- '[MITRE] Create Account'
Tests:
- Name: User Created
ExpectedResult: true
Log:
{
"p_event_time": "2024-10-09 19:43:05.007000000",
"p_log_type": "Snowflake.QueryHistory",
"BYTES_DELETED": 0,
"EXECUTION_STATUS": "SUCCESS",
"QUERY_TEXT": "CREATE USER MERCY\nPASSWORD = '\u263a\u263a\u263a\u263a\u263a'\nDEFAULT_ROLE = PUBLIC;",
"QUERY_TYPE": "CREATE_USER",
"ROLE_NAME": "ACCOUNTADMIN",
"USER_NAME": "LEX_LUTHOR",
"WAREHOUSE_NAME": "ADMIN_WH"
}
Detection logic
Condition
EXECUTION_STATUS eq "SUCCESS"
QUERY_TYPE eq "CREATE_USER"
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EXECUTION_STATUS | eq |
|
QUERY_TYPE | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
user | user_name |
role | role_name |
source | p_source_label |
warehouse | WAREHOUSE_NAME |