Academy
TermDefence

Query monitoring

Recording queries run on databases and data warehouses and monitoring them for unusual access and bulk data extraction.

Flow

  1. 1Logging
  2. 2Baseline
  3. 3Alerting
Related families
—
MITRE ATT&CK
T1213 · Data from Information Repositories
Sources
4 sources
01

Overview

An attacker signing in with stolen credentials looks like a legitimate user. The difference is in what they do: queries that list every table and copy large volumes of data. Google Cloud (Mandiant)

MITRE ATT&CK defines collecting data from information repositories as a separate technique; query logs are the most direct trace of this technique. MITRE ATT&CK

02

How it works

  1. 1

    Logging

    Each query is stored with the user, source address and time. MITRE ATT&CK

  2. 2

    Baseline

    Each account’s usual query volume and types are established.

  3. 3

    Alerting

    Bulk listing and export queries are flagged. Google Cloud (Mandiant)

03

Real-world examples

Snowflake: SHOW TABLES and COPY INTO

According to Mandiant, UNC5537 listed databases with SHOW TABLES, then copied data to a temporary stage with COPY INTO and exfiltrated it; a tool called FROSTBITE was used for access. Google Cloud (Mandiant)

04

How to detect it

05

What to do

  • Restrict data warehouse access to trusted networks and require multi-factor authentication. MITRE ATT&CK
06

MITRE ATT&CK

T1213Data from Information RepositoriesT1078Valid Accounts
07

Related terms

Terms

Data exfiltrationAccount takeoverLeak impact analysis
08

Sources

  1. 1Data from Information Repositories (T1213) · MITRE ATT&CK
  2. 2Valid Accounts (T1078) · MITRE ATT&CK
  3. 3UNC5537 targets Snowflake customer instances · Google Cloud (Mandiant), 2024
  4. 4Multi-factor Authentication (M1032) · MITRE ATT&CK