SaaS data exfiltration
Bulk SQL/API extraction from SaaS platforms with stolen credentials
categoryCloud, container and supply chain attacksseverityHighdetectabilityHighlabnot yet measured
Example: Snowflake/UNC5537 (~165 orgs)
Classification
42 values: 27 imported, 1 derived, 14 machine-classified. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Medium |
| Likelihood / prevalence | High |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityFinancial |
| Platform | IaaSIdentity ProviderLinuxmacOSOffice SuiteSaaSWindows |
| Environment | Cloud |
| Target asset class | Data storeIdentity |
| Kill-chain phase (tactic) | CollectionInitial AccessPersistencePrivilege EscalationStealth |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Application Log ContentCloud Service ModificationCloud Storage AccessCommand ExecutionFile AccessLogon Session CreationNetwork Connection CreationProcess CreationUser Account Authentication |
| Attack permissions (ATT&CK) | AdministratorUser |
Detection & response
Mitigated by 22
- M1015 attack-mitigation
- M1017 attack-mitigation
- M1018 attack-mitigation
- M1026 attack-mitigation
- M1027 attack-mitigation
- M1032 attack-mitigation
- M1036 attack-mitigation
- M1041 attack-mitigation
- M1047 attack-mitigation
- M1054 attack-mitigation
- M1060 attack-mitigation
D3-AAd3fendD3-ALd3fendD3-AMd3fendD3-CDPd3fendD3-DId3fendD3-DNRd3fendD3-NRAMd3fendD3-RDd3fendD3-RUAAd3fendD3-UAPd3fendD3-ULAd3fend
Detected by 54
- DET0413 attack-detection-strategy
- DET0546 attack-detection-strategy
0055ad1f-be85-4798-83cf-a6da17c993b3sigma039a7469-0296-4450-84c0-f6966b16dc6dsigma09438caa-07b1-4870-8405-1dbafe3dad95sigma0b4b72e3-4c53-4d5b-b198-2c58cfef39a9sigma11c767ae-500b-423b-bae3-b234450736edsigma16a71777-0b2e-4db7-9888-9d59cb75200bsigma195e1b9d-bfc2-4ffa-ab4e-35aef69815f8sigma1b45b0d1-773f-4f23-aedc-814b759563b1sigma28870ae4-6a13-4616-bd1a-235a7fad7458sigma28eea407-28d7-4e42-b0be-575d5ba60b2csigma2f575940-d85e-4ddc-af13-17dad6f1a0efsigma313e72de-0c0d-4d65-8c95-87f4d546ecebsigma340ee172-4b67-4fb4-832f-f961bdc1f3aasigma34d81081-03c9-4a7f-91c9-5e46af625cdesigma38360161-76c4-4283-842e-efcf997dafc8sigma3ec9a16d-0b4f-4967-9542-ebf38ceac7ddsigma49a268a4-72f4-4e38-8a7b-885be690c5b5sigma4afac85c-224a-4dd7-b1af-8da40e1c60bdsigma4d136857-6a1a-432a-82fc-5dd497ee5e7csigma4f77e1d7-3982-4ee0-8489-abf2d6b75284sigma4fe17521-aef3-4e6a-9d6b-4a7c8de155a8sigma5259cbf2-0a75-48bf-b57a-c54d6fabaef3sigma53bb4f7f-48a8-4475-ac30-5a82ddfdf6fcsigma547dfc53-ebf6-4afe-8d2e-793d9574975dsigma5496ff55-42ec-4369-81cb-00f417029e25sigma5afa454e-030c-4ab4-9253-a90aa7fcc581sigma5f521e4b-0105-4b72-845b-2198a54487b9sigma60f6535a-760f-42a9-be3f-c9a0a025906esigma6e78f90f-0043-4a01-ac41-f97681613a66sigma70ed1d26-0050-4b38-a599-92c53d57d45asigma77caf516-34e5-4df9-b4db-20744fea0a60sigma87cc6698-3e07-4ba2-9b43-a85a73e151e2sigma8ad1600d-e9dc-4251-b0ee-a65268f29addsigma8c944ecb-6970-4541-8496-be554b8e2846sigma8dee7a0d-43fd-4b3c-8cd1-605e189d195esigma908655e0-25cf-4ae1-b775-1c8ce9cf43d8sigma9a60e676-26ac-44c3-814b-0c2a8b977adfsigmaa0413867-daf3-43dd-9245-734b3a787942sigma- … and 14 more in the database
Tested by 3
348f4d14-4bd3-4f6b-bd8a-61237f78b3acatomic3a159042-69e6-4398-9a69-3308a4841c85atomic9fdd83fd-bd53-46e5-a716-9dec89c8ae8eatomic
Attack relationships
- Parent: Compromised insider
- Parent: Vendor credential abuse
Framework references
- Primary source: https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion
- attack: T1213 (primary)
- attack: T1078.004
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Cloud, container and supply chain attacks' table, line 402 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1213, attack:T1078.004 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 21 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 4 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)