Anvilogic high experimental other

Snowflake USE ROLE ACCOUNTADMIN Database Query [snowflake-database_query_history]

Detects when a Snowflake user attempts to elevate their permissions to the ACCOUNTADMIN role.

View Source

Detection Logic

select * from snowflake.account_usage.query_history where event_time > dateadd(hour, -2, sysdate()) and (signature = 'UNKNOWN' or signature = 'USE') and REGEXP_LIKE(query, 'USE\\\s+ROLE\\\s+ACCOUNTADMIN.*', 'is')

Field Validations

Loading…

Comments (0)

Loading comments...