Snowflake Detection Pack
38 detection rules for Snowflake query history, login events, and access history — covering data exfiltration to external stages, ACCOUNTADMIN abuse, mass row queries, and insider data access. Protect your data warehouse.
Pack summary
- Detection rules
- 38
- Critical severity
- 9
- Log sources
- 4
- ATT&CK techniques
- 12
What's included
38 rules across 5 threat categories protecting your Snowflake data warehouse.
External stage COPY INTO, mass row queries, data sharing to external accounts, time travel abuse.
ACCOUNTADMIN direct usage, role grants, stored procedure privilege context, new user creation.
MFA bypass, brute force, login from new country, credential stuffing patterns.
DROP TABLE in production, Snowpipe disruption, fail-safe alteration, schema changes.
Network policy removal, access history gaps, external function to unknown endpoints.
Detection rules (20 of 38 shown)
Showing 20 representative rules. All 38 rules activate with one click.
| Rule name | Severity |
|---|---|
| Snowflake Data Export to External Stage — S3 or Azure Blob | Critical |
| Snowflake Mass Row Query — Unusual Volume | High |
| Snowflake Network Policy Removed or Relaxed | Critical |
| Snowflake ACCOUNTADMIN Role Used Directly (Non-Break-Glass) | Critical |
| Snowflake User Created by Non-Admin | High |
| Snowflake MFA Bypass — Password Authentication Only | High |
| Snowflake Warehouse Scaled Up — Cryptomining Pattern | Medium |
| Snowflake Table Drop or Truncate — Production Database | Critical |
| Snowflake Data Sharing — New External Share Created | High |
| Snowflake Credential Harvesting — SHOW USERS / SHOW ROLES | High |
| Snowflake Login Failure Spike — Brute Force Pattern | High |
| Snowflake Time Travel Query on Sensitive Table | Medium |
| Snowflake External Function Created to Unknown Endpoint | High |
| Snowflake SYSADMIN Role — DDL Outside Change Window | High |
| Snowflake Fail-Safe or Snowpipe Disruption | High |
| Snowflake Login from New Country | High |
| Snowflake Query Returning PII Columns — Volume Spike | High |
| Snowflake Role Grant to Service Account — Unexpected Privilege | High |
| Snowflake Stored Procedure Created with Admin Privilege Context | High |
| Snowflake Audit Log — Access History Gap | Critical |
Prerequisites
- Snowflake service account with ACCOUNTUSAGE database read permission (GRANT IMPORTED PRIVILEGES ON DATABASE SNOWFLAKE)
- ACCOUNT_USAGE share enabled in Snowflake — available for accounts on Business Critical and above
- Query and login history latency is up to 3 hours in ACCOUNT_USAGE; enable Event Table for real-time audit logging
- Snowflake data classification tags applied to sensitive tables for enriched exfiltration alerts (optional but recommended)
Snowflake Detection Pack: frequently asked questions
What Snowflake log sources does this detection pack use?
The Snowflake detection pack uses Query History (SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY), Login History (LOGIN_HISTORY), Access History (ACCESS_HISTORY), and Task History views from the ACCOUNT_USAGE schema. ManySignal connects via a dedicated service account with ACCOUNTUSAGE database read access, querying the ACCOUNT_USAGE views on a configurable polling interval.
How does ManySignal detect Snowflake data exfiltration?
Snowflake data exfiltration detection uses three approaches: volume anomaly (queries returning row counts anomalous relative to the user's historical baseline), destination analysis (COPY INTO commands targeting external stages outside known corporate storage accounts), and access pattern analysis (sudden access to tables the user has never queried before, particularly those with data classification tags).
Can ManySignal detect credential stuffing attacks against Snowflake?
Yes. Login History tracks failed authentication attempts with username, IP address, and timestamp. ManySignal detects brute force and credential stuffing by identifying users with an anomalous failure-to-success ratio, rapid failures from multiple IPs (distributed stuffing), and logins from IPs associated with known credential stuffing infrastructure.
Does this pack support Snowflake Horizon data classification?
Yes. When Snowflake Horizon classification tags are applied to tables (PII, PCI, HIPAA), ManySignal reads the ACCESS_HISTORY view's object references and cross-references with classification metadata. Queries touching classified tables generate enriched alerts that include the data classification of each accessed object.
How does ManySignal handle Snowflake Virtual Private Snowflake (VPS) deployments?
For VPS deployments, ManySignal connects via a private link or PrivateLink endpoint to access the ACCOUNT_USAGE views. The connection uses a dedicated Snowflake service account with read-only access to SNOWFLAKE database views. No production data is accessed — only metadata and audit views.
Detect data exfiltration from Snowflake before data leaves your warehouse
38 Snowflake detection rules covering external stage exports, ACCOUNTADMIN abuse, and mass data queries from the ACCOUNT_USAGE schema.