Anvilogic high experimental other

Snowflake Monitor Usage [snowflake-database_query_history]

This use case detects the MONITOR USAGE query. - Threat Actor Association: UNC5537 - Software Association: rapeflake

View Source

Detection Logic

select * from snowflake.account_usage.query_history where event_time > dateadd(hour, -2, sysdate()) and query_text ilike 'monitor usage%'

Field Validations

Loading…

Comments (0)

Loading comments...