Common signs include repeated recon queries like SHOW TABLES, bulk extraction patterns such as SELECT * and COPY INTO, creation of temporary storage, unusual use of database clients like DBeaver, and unexpected role grants or other impactful changes. Large result sets and access from suspicious IPs can also indicate that an attacker is testing the environment or preparing exfiltration.
Why Hidden Activity in Snowflake Becomes Detectable
Snowflake is attractive to attackers because it can hold large data volumes and support rapid query-driven extraction, but that same flexibility also produces telemetry when the environment is being probed or abused. Repeated reconnaissance queries, broad table enumeration, staged export activity, and unusual client behavior often reveal that the attacker is not blending into normal analyst work. The more an intruder pushes for scale, the more they tend to leave a pattern in query history, role changes, and access paths.
What matters most is not a single suspicious command, but a cluster of actions that do not fit the account’s normal purpose. Reconnaissance that accelerates into extraction usually creates a visible shift from selective access to repeated, high-volume reads and outbound preparation. In practice, many security teams discover the issue only after a query pattern becomes noisy enough to resemble an operator testing the limits of the environment rather than a legitimate user.
Snowflake-specific investigations benefit from comparing the observed account behavior against the expected workload, since attacker tradecraft often shows up as repetition, breadth, and tool choice rather than a single obvious exploit. For broader attack pattern context, MITRE’s MITRE ATT&CK Enterprise Matrix is useful for mapping activity to credential access, discovery, and exfiltration patterns.
How Failing Stealth Usually Looks in Practice
When attacker activity starts losing stealth in Snowflake, the environment often shows a progression from low-friction discovery to operational preparation. Early signs include repeated metadata enumeration, broader-than-normal table access, and query bursts that do not match the user’s historical rhythm. Once the attacker believes the account is viable, the focus usually shifts to extracting data efficiently, which can create large result sets, bulk reads, and export-oriented statements.
Suspicious use of database clients is another common clue. Tools such as DBeaver are not inherently malicious, but they can stand out when paired with an identity that normally uses automated pipelines or browser access. The same applies to unexpected role grants, privilege changes, or creation of temporary storage locations that would not normally appear in the account’s operating pattern. Those changes often indicate that the intruder is trying to widen access, stage output, or make exfiltration easier.
- Discovery noise: repeated SHOW-style enumeration, schema walking, and broad object listing.
- Extraction noise: SELECT * patterns, unusually large result sets, and repeated reads across many tables.
- Preparation noise: COPY INTO usage, temporary storage creation, and export workflows that do not match the account’s normal purpose.
- Access noise: unfamiliar clients, suspicious IP ranges, and role or privilege changes that expand reach.
Snowflake activity becomes easier to spot when these signals cluster within a short window, because the attacker is balancing speed against caution and often loses one to the other. For deeper context on Snowflake abuse patterns and identity-driven compromise, NHIMG’s Snowflake breach research is directly relevant, and CISA’s cyber threat advisories provide useful public-reference framing for intrusion patterns and response cues.
These controls tend to break down when large legitimate analytics jobs, shared service accounts, or poorly baselined admin activity create enough noise to hide the attacker’s deviations.
When a Suspicious Pattern Is a True Compromise Signal
Tighter detection often increases false positives, so teams have to balance sensitivity against the operational cost of chasing legitimate analyst work. The practical test is whether the activity both departs from normal usage and aligns with a known attacker objective such as discovery, privilege expansion, or bulk extraction.
Current guidance suggests treating the following as stronger compromise indicators than any single query alone: repeated discovery across many objects, export behavior that follows immediately after reconnaissance, unexpected access from new networks or regions, and role changes that materially increase what the account can reach. A low-and-slow actor may stay quiet longer, but once the pattern becomes repetitive, broad, and export-oriented, it is usually because the operator is trying to complete the job before detection closes in.
One useful validation step is to compare the observed sequence against the account’s usual purpose. If an identity that normally runs narrow application queries suddenly enumerates schemas, stages data, and exports large result sets, the likelihood of hostile use rises quickly. The same is true when the activity chain includes privilege changes that appear to support collection rather than normal administration.
Practitioner takeaway: The most reliable signal is not a single suspicious statement, but a shift from ordinary workload behavior to repeated discovery, expansion, and export in a pattern that fits attacker tradecraft better than business use.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1087 — Account Discovery | Repeated Snowflake enumeration mirrors discovery of users, roles, and objects. |
| T1046 — Network Service Discovery | Suspicious probing and recon in Snowflake reflect service discovery behavior. | |
| T1213 — Data from Information Repositories | Bulk SELECT and COPY activity indicate collection from a data repository. | |
| Recommendation — Map repeated enumeration to discovery techniques and alert on abnormal object-lookup bursts. Correlate recon queries with service discovery patterns to detect early attacker probing. Hunt for high-volume reads and staged exports as repository collection activity. | ||
| CIS Controls v8 | 6 — Access Control Management | Unexpected role grants and privilege changes signal access expansion. |
| 8 — Audit Log Management | Snowflake query history and client/IP changes are key evidence sources. | |
| 13 — Network Monitoring and Defense | Suspicious IPs and unusual client use need network-level visibility. | |
| Recommendation — Review and revoke unexpected grants that expand account reach beyond job need. Centralise query and role-change logs so anomalous access patterns are reviewable. Flag access from unexpected sources and correlate it with account activity. | ||
| OWASP Non-Human Identity Top 10 | NHI-06 — Detection and Monitoring | Compromised machine or service identities often show repetitive discovery and export activity. |
| NHI-03 — Secrets and Credential Management | Snowflake abuse commonly follows credential or token compromise. | |
| Recommendation — Baseline NHI behavior and alert on discovery-to-export sequences that deviate from normal use. Rotate exposed credentials quickly and reduce the lifetime of standing access. | ||
| NIST CSF 2.0 | DE.CM — Continuous Monitoring | Anomalous Snowflake activity is detected through ongoing telemetry review. |
| PR.AC — Identity Management, Authentication and Access Control | Role changes and suspicious access paths show access-control misuse. | |
| Recommendation — Continuously monitor query, role, and access telemetry for abnormal behavioral shifts. Enforce least privilege and investigate access changes that do not match normal operations. | ||
Related resources from NHI Mgmt Group
- What are the signs that a trojan is using persistence and command retrieval to stay hidden?
- What are the signs that a Snowflake account has been misused after credential exposure?
- What are the signs that traditional identity controls are failing against modern identity attacks?
- What are the signs that an MCP tool is being abused to extract hidden context?
