Anvilogic critical experimental other

Snowflake Drop User [snowflake-database_query_history]

Removes the specified user from the system.

View Source

Detection Logic

select * from snowflake.account_usage.query_history where event_time > dateadd(hour, -2, sysdate()) and signature ilike 'drop_user' and query ilike 'drop user%'

Field Validations

Loading…

Comments (0)

Loading comments...