A guide to threat hunting and monitoring in Snowflake

This guide outlines practical threat-hunting methods for Snowflake environments in response to an emerging campaign targeting Snowflake credentials, providing ready-to-use SQL queries, IOCs (malicious IPs and client identifiers), and clear “what to look for” guidance to detect suspicious logins, unapproved clients (e.g., DBeaver, rapeflake), network policy changes, privilege escalation, OAuth token misuse, brute-force patterns, large data access, and exfiltration via COPY INTO, stages, and anomalous data transfers, along with recommended security best practices.