Anvilogic critical experimental other

Snowflake Drop Table [snowflake-database_query_history]

This use case detects the DROP TABLE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

View Source

Detection Logic

select * from snowflake.account_usage.query_history where event_time > dateadd(hour, -2, sysdate()) and query_text ilike 'drop table%'

Field Validations

Loading…

Comments (0)

Loading comments...