Classification:

attack

Tactic:

TA0010-exfiltration

Technique:

T1567-exfiltration-over-web-service

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect anomalous transfer of data to an external cloud provider in your Snowflake environment.

Strategy

This rule allows you to detect when an external data transfer occurs to an unexpected cloud provider in Snowflake. Data transfers include @source_cloud, @bytes_transferred, and @source_region that can be compared with the @target_cloud and @target_region. This behavior can be traced to known data transfers from expected cloud environments. If the source and target destinations do not match, consider further investigation to determine if this is a potential indicator of data exfiltration.

Triage and response

1. Inspect the logs to identify the target cloud, target region, and transfer type.
2. Investigate whether that cloud region is expected.
3. Using the transfer type and start time, correlate the behavior with other logs to determine user, query, and other useful information.
4. If there are signs of compromise, disable the user associated with the transfer and rotate credentials.