Snowflake new data transfer to location

This rule is part of a beta feature. To learn more, contact Support.
snowflake

Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1537-transfer-data-to-cloud-account

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect anomalous transfer of data to an external cloud provider in your Snowflake environment.

Strategy

This rule allows you to detect when an external data transfer occurs to an unexpected cloud provider in Snowflake. Data transfers include @source_cloud, @bytes_transferred, and @source_region that can be compared with the @target_cloud and @target_region. This behavior can be traced to known data transfers from expected cloud environments. If the source and target destinations do not match, consider further investigation to determine if this is a potential indicator of data exfiltration.

Triage and response

  1. Inspect the logs to identify the target cloud, target region, and transfer type.
  2. Investigate whether that cloud region is expected.
  3. Using the transfer type and start time, correlate the behavior with other logs to determine user, query, and other useful information.
  4. If there are signs of compromise, disable the user associated with the transfer and rotate credentials.