Snowflake new data transfer to location

This rule is part of a beta feature. To learn more, contact Support.
snowflake

Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1567-exfiltration-over-web-service

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect anomalous transfer of data to an external cloud provider in your Snowflake environment.

Strategy

This rule allows you to detect when an external data transfer occurs to an unexpected cloud provider in Snowflake. Data transfers include @source_cloud, @bytes_transferred, and @source_region that can be compared with the @target_cloud and @target_region. This behavior can be traced to known data transfers from expected cloud environments. If the source and target destinations do not match, consider further investigation to determine if this is a potential indicator of data exfiltration.

Triage and response

  1. Inspect the logs to identify the target cloud, target region, and transfer type.
  2. Investigate whether that cloud region is expected.
  3. Using the transfer type and start time, correlate the behavior with other logs to determine user, query, and other useful information.
  4. If there are signs of compromise, disable the user associated with the transfer and rotate credentials.