detection.wiki

Detection rules › Panther

Snowflake User Enabled

Severity
informational
Tags
Snowflake, Persistence:Create Account
Source
github.com/panther-labs/panther-analysis

Detect users being re-enabled in your environment

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1136 Create Account

Rule body yaml

AnalysisType: scheduled_rule
Filename: snowflake_user_enabled.py
RuleID: "Snowflake.UserEnabled"
Description: >
  Detect users being re-enabled in your environment
DisplayName: "Snowflake User Enabled"
Enabled: false
ScheduledQueries:
  - Query.Snowflake.UserEnabled
Severity: Info
Tags:
  - Snowflake
  - Persistence:Create Account
Reports:
  MITRE ATT&CK:
    - TA0003:T1136
Tests:
  - Name: Return True
    ExpectedResult: true
    Log:
      query_text: "alter user TESTUSER set disabled=false;"
  - Name: Unknown User
    ExpectedResult: true
    Log:
      query_text: "alter"
      user_name: admin

Detection logic

Filter

def rule(_):
    return True


def title(event):
    query_text = event.get("query_text", "").split(" ")
    if len(query_text) > 2:
        return (
            f"Snowflake user [{query_text[2]}] "
            f"enabled by [{event.get('user_name','<UNKNOWN_ADMIN>')}]"
        )
    return (
        f"Snowflake user [<UNKNOWN_USER>] enabled by [{event.get('user_name','<UNKNOWN_ADMIN>')}]"
    )

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
user_name