Use Case: Data
Anomalous data warehouse access
Stolen Snowflake credentials were used to run SELECT * on 3 tables containing 200M customer records at 4 AM from a new IP. No MFA challenge. No alert. Until ManySignal.
The data warehouse as exfiltration target
Data warehouses are the most concentrated data stores in most organizations — every customer record, transaction, and analytics dataset in one place. Snowflake, Databricks, and BigQuery give query access to vast quantities of data through simple SQL. An attacker with a valid credential and network access can run SELECT * FROM customer_data and download terabytes of records — no file system access required, no malware needed, just SQL and an internet connection.
The 2024 Snowflake breach demonstrated the scale: credential stuffing attacks against Snowflake customers (who hadn't enabled MFA) resulted in data breaches at Ticketmaster, AT&T, and hundreds of other organizations. The attackers' initial access looked like normal Snowflake login events.
rule: data_warehouse_anomalous_access
type: behavioral + query_analysis
sources:
- snowflake_query_history
- snowflake_login_history
- databricks_unity_catalog_audit
- bigquery_cloud_audit_logs
trigger:
- OR:
- condition: |
login.client_ip NOT IN user.known_ips
AND login.mfa_used == false
- condition: |
query.tables_accessed.new_to_user == true
AND query.rows_returned > 100000
- condition: |
query.statement_type == "COPY INTO"
AND query.destination_type == "external_stage"
enrichments:
- table_classification: pii_tables, financial_tables, custom_tags
- query_volume: data_bytes_transferred
- credential_breach_check: hibp, spycloud
- mfa_policy_status: snowflake_account_policy
mitre: T1530 (Data from Cloud Storage), T1048 (Exfiltration Over Alternative Protocol)MITRE ATT&CK mapping
Data warehouse access FAQ
How does ManySignal detect anomalous Snowflake queries?
ManySignal analyzes Snowflake query history, access logs, and login events. Anomalous patterns include: queries targeting tables the user has never accessed before, LIMIT-less SELECT statements on large PII tables, queries run at unusual times or from unusual client tools, bulk COPY INTO operations to external stages, and authentication from new IP addresses or client applications.
Was the 2024 Snowflake breach relevant to this detection?
Directly. In 2024, threat actors using credential stuffing obtained valid Snowflake credentials for customers including Ticketmaster and Santander. Because Snowflake by default doesn't enforce MFA, the attackers accessed customer data warehouses directly without any controls stopping them. ManySignal's Snowflake monitoring would have detected both the new-IP authentication and the bulk data access pattern within the first query session.
Does ManySignal monitor Databricks and BigQuery in addition to Snowflake?
Yes. Data warehouse monitoring covers Snowflake, Databricks (via Unity Catalog audit logs), Google BigQuery (via Cloud Audit Logs), Amazon Redshift (via CloudTrail), and Azure Synapse Analytics (via Azure Monitor). The same anomalous query detection logic applies across all platforms.
Can ManySignal enforce MFA on Snowflake sessions?
ManySignal cannot enforce Snowflake MFA directly — that's a Snowflake configuration setting. However, ManySignal can detect authentication sessions that don't use MFA (identifiable in the Snowflake login history) and flag them as policy violations, prompting remediation via Snowflake's network policy configuration.
Monitor Snowflake and Databricks for anomalous query patterns
Behavioral baseline detection for data warehouse access — catches the credential stuffing attacks that MFA would prevent but your audit logs don't surface.