detection.wiki

Detection rules › Panther

Snowflake User Created

Severity
informational
Tags
Snowflake, Persistence:Create Account
Source
github.com/panther-labs/panther-analysis

Detect new users created in snowflake

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1136 Create Account

Rule body yaml

AnalysisType: scheduled_rule
Filename: snowflake_user_created.py
RuleID: "Snowflake.UserCreated"
Description: >
  Detect new users created in snowflake
DisplayName: "Snowflake User Created"
Enabled: false
ScheduledQueries:
  - Query.Snowflake.UserCreated
Severity: Info
Tags:
  - Snowflake
  - Persistence:Create Account
Reports:
  MITRE ATT&CK:
    - TA0003:T1136
Tests:
  - Name: Return True
    ExpectedResult: true
    Log:
      query_text: "create USER testuser password='☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺☺' default_role = 'READONLY' must_change_password = true;"
      user_name: admin
  - Name: IF NOT EXISTS syntax extracts correct username
    ExpectedResult: true
    Log:
      query_text: "CREATE USER IF NOT EXISTS SERVICE_ACCOUNT_XYZ DEFAULT_ROLE = SERVICE_ROLE TYPE='SERVICE' RSA_PUBLIC_KEY = 'REDACTED'"
      user_name: PANTHER_ADMIN
  - Name: Unknown User
    ExpectedResult: true
    Log:
      query_text: "create"
      user_name: admin

Detection logic

Filter

import re

_CREATE_USER_RE = re.compile(r"CREATE\s+USER\s+(?:IF\s+NOT\s+EXISTS\s+)?(\S+)", re.IGNORECASE)


def rule(_):
    return True


def title(event):
    match = _CREATE_USER_RE.search(event.get("query_text", ""))
    username = match.group(1) if match else "<UNKNOWN_USER>"
    return (
        f"Snowflake user [{username}] created by " f"[{event.get('user_name', '<UNKNOWN_ADMIN>')}]"
    )

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
user_name