STRIFEBOT: Attacking and Defending Snowflake Data-lakes

STRIFEBOT: Attacking and Defending Snowflake Data-lakes

Speakers: James Henderson, Reverse Sec

Conference: fwd:cloudsec Europe 2025

YouTube: https://www.youtube.com/watch?v=6u97AYYXiqM

Overview

James Henderson from Reverse Sec delivered a comprehensive purple teaming framework for Snowflake data lake environments, covering the full attack lifecycle from initial access through persistence to data exfiltration. Motivated by the high-profile 2024 Snowflake breaches—where attackers used info-stealer-compromised credentials to exfiltrate data from multiple customer tenants—Henderson systematically mapped offensive techniques against Snowflake's platform, paired them with detection strategies and preventive controls, and open-sourced the resulting playbooks. The talk addresses a critical gap in security operations: as organizations migrate their crown jewel data into SaaS data platforms, traditional security testing methodologies built for Active Directory and cloud infrastructure often fail to cover these new attack surfaces.

Background

▶ Watch: Overview of the 2024 Snowflake breaches — info-stealer to credential theft to... (1:30)

In 2024, a series of well-publicized attacks against Snowflake customers demonstrated that data lake platforms have become prime targets. As documented in Mandiant's incident response report, the attacks did not exploit a platform vulnerability—they leveraged stolen credentials from info-stealer malware on administrator workstations, followed by rapid data exfiltration using Snowflake's native data sharing features. Snowflake operates on a shared responsibility model: the vendor manages hardware and software, while customers manage their own users, settings, and data security. The platform uses a SQL-centric interface where virtually every operation—from user management to data export—is executed via SQL statements. Henderson observed that while mature tooling and methodology exist for purple teaming Windows environments, Active Directory, and even AWS/Azure cloud infrastructure, equivalent frameworks for SaaS data platforms like Snowflake have been largely absent.

Key Findings

▶ Watch: Reverse-engineers Snowflake IAM — human users vs service accounts and their a... (6:30)

Henderson's research identified multiple attack vectors across the Snowflake attack lifecycle. For initial access, the primary risk vectors are password brute forcing and spraying against accounts without MFA, cookie theft from SSO-authenticated sessions, credential theft from Snowflake config files on workstations, and service account key theft from version control or application environments. For persistence, attackers with sufficient privileges can reset user passwords, add MFA devices, create backdoor users, modify IP restriction policies, and—uniquely to Snowflake—create scheduled functions in Java, Python, or SQL that execute with the creator's privileges, enabling time-windowed backdoor access. For exfiltration, Snowflake's nature as a data sharing platform provides attackers with an unusually rich set of options: direct file downloads, copying data to attacker-controlled S3 buckets (including anonymous public buckets without credentials), creating external stages as formal cloud storage integrations, sending data over the network via Python functions, and using native Snowflake data sharing features like shares and listings to share data with attacker-controlled accounts.

Technical Deep Dive

▶ Watch: Comprehensive exfiltration techniques including anonymous S3 copying, externa... (11:30)

Snowflake's architecture consists of organizations containing multiple accounts, each with settings, functions, and data organized in a traditional SQL hierarchy of databases, schemas, and tables. The platform integrates tightly with cloud storage services, making cross-cloud data movement a first-class feature.

The identity and access management model distinguishes between human users (supporting passwords, federated SSO, and RSA access tokens) and service accounts (supporting RSA keys and OAuth). Henderson emphasized that federated access through an SSO identity provider is the recommended and most secure authentication method, as it inherits existing conditional access policies. Native password authentication remains the weakest link, particularly when combined with absent MFA.

For exfiltration techniques, the external stage mechanism—the same technique used in the 2024 breaches—deserves particular attention. External stages create formal integrations between Snowflake and cloud storage buckets, requiring an integration to be defined first. However, Snowflake also allows anonymous copying to public S3 buckets without any integration, making exfiltration trivially easy for any user with data read access. The network function exfiltration path is equally concerning: Python functions executing within Snowflake can read table data and POST it to arbitrary external endpoints, combining data access with network egress in a single operation.

On the detection side, Snowflake provides several key log sources. The login_history and session tables offer visibility into authentication events including IP addresses, client identifiers, and authentication methods. Object modification logs capture persistence activities like user creation and privilege changes. The stages log tracks data sharing configuration changes, and a dedicated data transfer log records volume, timing, and destination of data leaving the account. Critically, Snowflake logs all SQL queries in a query_history table, meaning every attacker action is recorded—though Henderson cautioned that raw string matching against SQL queries requires fuzzy matching to handle variations in spacing and formatting.

Henderson recommended a layered detection strategy: hard-coded alerts for high-fidelity signals (like SQL-based MFA device additions), visual dashboards for threat hunting by human analysts who can assess behavioral context, and behavioral analytics for anomaly detection once sufficient baseline data exists.

Demo / Proof of Concept

▶ Watch: Announces open-source STRIFEBOT playbooks on GitHub with all attack SQL comma... (14:00)

While Henderson did not perform a live demo, he walked through the complete attack simulation methodology and referenced the open-sourced STRIFEBOT playbooks on GitHub, which contain the specific SQL commands, required permissions, and step-by-step procedures for executing each offensive technique against a Snowflake environment. The playbooks are designed for organizations to run against their own environments as part of purple team exercises.

Defensive Implications

▶ Watch: Exfiltration prevention matrix — mapping each technique to specific preventiv... (20:00)

Henderson outlined a multi-layered defensive strategy. Preventive controls should prioritize RBAC enforcement to ensure dangerous operations are restricted to privileged roles, federated authentication over native passwords, mandatory MFA for all human accounts, egress restrictions using Snowflake's integration controls, and data tokenization so that raw sensitive data (PII, PHI) is never stored directly in Snowflake. For exfiltration prevention specifically: disable anonymous cloud storage access to force all data export through formally defined security integrations, restrict integration and data sharing creation to a small set of admin users via RBAC, and maintain IP restrictions as a defense-in-depth measure. On the detection side, ensure Snowflake logs are ingested into SIEM platforms, monitor login behavior for anomalous patterns, create alerts for security-critical operations, and continuously audit data sharing configurations for unrecognized connections. Henderson also emphasized that organizations must secure the surrounding ecosystem—CI/CD pipelines, admin workstations, and connected cloud environments—as these are the most likely initial access vectors.

Key Takeaways

• Data lakes are increasingly targeted for exfiltration and should be included in security testing programs alongside traditional infrastructure
• Snowflake's data sharing features are a double-edged sword—the same capabilities that make it a powerful platform also provide attackers with rich exfiltration options including anonymous S3 bucket copying
• Purple team exercises should be extended to SaaS platforms by systematically mapping initial access, persistence, and exfiltration techniques specific to each platform
• Federated authentication and MFA are the most impactful preventive controls for initial access, while RBAC and egress restrictions address persistence and exfiltration
• Snowflake's immutable query logging provides comprehensive forensic capability, but detection requires context-aware analysis rather than simple pattern matching
• Securing adjacent systems (CI/CD, workstations, connected cloud accounts) is essential—the platform itself is rarely the weakest link

About the Speaker(s)

James Henderson is a security consultant at Reverse Sec, a UK-based security company. He specializes in purple team exercises and has extensive experience testing traditional on-premises environments, Active Directory, and cloud platforms including AWS and Azure. His recent work has focused on extending offensive security methodologies to SaaS platforms and data lakes as organizations migrate critical data to these platforms.