detection.wiki

Detection rules › Panther

Snowflake User Daily Query Volume Spike

Severity
low
Tags
Snowflake, Behavior Analysis, Exfiltration:Exfiltration Over Web Service
Source
github.com/panther-labs/panther-analysis

Returns instances where a user's cumulative daily query volume is much larger than normal. Could indicate exfiltration attempts.

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1567 Exfiltration Over Web Service

Rule body yaml

AnalysisType: scheduled_rule
Filename: snowflake_user_query_volume_spike.py
RuleID: "Snowflake.Stream.UserDailyQueryVolumeSpike"
DisplayName: "Snowflake User Daily Query Volume Spike"
Enabled: true
ScheduledQueries:
  - "Snowflake User Daily Query Volume Spike"
Severity: Low
Reports:
  MITRE ATT&CK:
    - TA0010:T1567
Description: >
  Returns instances where a user's cumulative daily query volume is much larger than
  normal. Could indicate exfiltration attempts.
Runbook: >
  Review the user's query history for the past day. Identify any large queries
  and determine if any data was accessed that shouldn't be.
Tags:
  - Snowflake
  - Behavior Analysis
  - Exfiltration:Exfiltration Over Web Service
Tests:
  - Name: High Query Volume
    ExpectedResult: true
    Log:
      {
        "p_source_id": "26c3f2be-005e-443a-90cb-f623522f37a2",
        "p_source_label": "SF Prod",
        "daily_bytes": 1376806.35210866,
        "mean": 729289.7142857143,
        "std_dev": 206110.99016770572,
        "tend": "2024-10-21 22:09:13.47Z",
        "tstart": "2024-10-20 22:09:13.47Z",
        "USER_NAME": "ZEEBLE_BROMBUS",
        "zscore": 3.141592,
      }

Detection logic

Filter

def rule(_):
    return True


def title(event):
    username = event.get("user_name", "<UNKNOWN USER>")
    source = event.get("p_source_label", "<UNKNOWN SOURCE>")
    return f"{source}: Abnormally large query volume from user {username}"

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field
p_source_label
user_name