Microsoft Sentinel medium experimental kql

Snowflake - Possible privileges discovery activity

'Detects possible privileges discovery activity.'

View Source

Detection Logic

Snowflake
| where QueryType =~ 'SHOW'
| where QueryText has_all ('SHOW', 'ROLES')
| extend AccountCustomEntity = TargetUsername

Field Validations

Loading…

Comments (0)

Loading comments...