Anvilogic high experimental other

Snowflake Alter Stage [snowflake-database_query_history]

This use case detects the ALTER STAGE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

View Source

Detection Logic

select * from snowflake.account_usage.query_history where event_time > dateadd(hour, -2, sysdate()) and query_text ilike 'alter stage%'

Field Validations

Loading…

Comments (0)

Loading comments...