Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1528-steal-application-access-token

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect abnormal OAuth access token usage in your Snowflake environment.

Strategy

This rule allows you to detect when an account authenticates with an OAuth access token outside an automated service/driver.

OAuth access tokens act like digital keys that grant access to protected resources. If an attacker compromises a user account, they might steal the associated access token.

By reviewing access token usage during an incident, you can identify unusual activity patterns. This could involve:

• Access tokens being used from unexpected locations (attacker’s IP address).
• Access tokens being used to access unauthorized resources.
• A sudden spike in access token usage.

Triage and response

1. Inspect the logs to see if the IP address is aligned with expected user or service account behavior.
2. If the IP address has not been seen before and is followed by query activity, investigate the actions taken.
3. If the account was compromised, recreate the access token.