From Snowflake to Snowstorm:Navigating Breaches and Detections
summary
A campaign against Snowflake compromises 165 organizations by buying stolen credentials and logging in — no zero days, no custom malware — then using native Snowflake queries to exfiltrate data to staging buckets and extort or sell it. Detection relies on enabling and collecting the right logs (including object-level logs), running the vendor-supplied Snowflake queries, building behavioral baselines, integrating threat intel and automating credential rotation; similar incidents include 1.6 TB of Slack messages exfiltrated via compromised accounts.
AI-written summary · about
chapters (13)
- 0:00Snowflake breach campaign intro
- 3:15How breach unfolded
- 7:55Cloud and SAS migration
- 10:25Rising cloud breaches
- 13:55Midnight Blizzard on Azure
- 15:42Detecting cloud attacks
- 17:27Visibility gaps in logs
- 23:54Identity as perimeter
- 27:42Skill gaps in cloud defense
- 31:38Roles for cloud security
- 34:28Incident response planning
- 37:26Cloud detection strategies
- 40:18Steps to improve cloud security
related talks
42mThreat Detection across all environments with SnowflakeData Security Lake
37mCloud warehouse monitoring ( Snowflake case study )
52mHow Snowflake uses Snyk to give data-driven analytics for security
46mCritical SaaS, Critical Blind Spots: A Detection Engineer's Field Guide to SaaS Attacks
43mHacking the Cloud: Play-by-Play Attack on GitHub, Okta, and Salesforce
48mCatch Me if You Can: Hunting Cloud Exfiltration Using Anomaly Detection
59mInside the Breach: Secrets Exposed
39mHow Security Incidents Are Different ... and How They're Exactly the Same