detection.wiki

Detection rules › Panther

Suspicious Snowflake Sessions - Unusual Application

Severity
low
Group by
client_application, client_os, client_os_version
Tags
Snowflake, Behavior Analysis, Initial Access:Valid Accounts:Cloud Accounts
Source
github.com/panther-labs/panther-analysis

Detects unusual (non-common) applications and client characteristics that have been used to connect to a Snowflake account

MITRE ATT&CK coverage

TacticTechniques
Initial AccessT1078.004 Valid Accounts: Cloud Accounts

Rule body yaml

AnalysisType: scheduled_rule
Filename: snowflake_suspicious_session.py
RuleID: "Snowflake.Stream.SuspiciousSession.UnusualApp"
DisplayName: Suspicious Snowflake Sessions - Unusual Application
Enabled: true
ScheduledQueries:
  - "Suspicious Snowflake Sessions - Unusual Application"
Severity: Low
Reports:
  MITRE ATT&CK:
    - TA0001:T1078.004
Description: Detects unusual (non-common) applications and client characteristics
  that have been used to connect to a Snowflake account
DedupPeriodMinutes: 1440
Tags:
  - Snowflake
  - Behavior Analysis
  - Initial Access:Valid Accounts:Cloud Accounts
Tests:
  - Name: New Session
    ExpectedResult: true
    Log:
      {
        "p_source_id": "26c3f2be-005e-443a-90cb-f623522f37a2",
        "p_source_label": "SF Prod",
        "client_application": "Snowflake Web App",
        "first_seen": "2024-10-09 14:48:33.284",
        "last_seen": "2024-10-09 15:01:13.492",
        "n_sessions": 83
      }

Detection logic

Filter

def rule(_):
    return True


def title(event):
    return f"{event.get('p_source_label', '<UNKNOWN SOURCE>')}: Suspicious Application Session"


def dedup(event):
    return "-".join(
        (
            event.get("client_application", "<UNKNOWN APP>"),
            event.get("client_os", "<UNKNOWN OS>"),
            event.get("client_os_version", "<UNKNOWN VERSION>"),
        )
    )

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
p_source_label