Proposal: support Snowflake as an Atomic Red Team execution platform

Summary

Add Snowflake as a supported Atomic Red Team execution platform so defenders can safely validate cloud data-platform detections for valid-account abuse, schema reconnaissance, and bulk data access.

Motivation

Current supported_platforms values do not provide a native way to represent Snowflake tests. Public reporting on UNC5537 documents widespread abuse of infostealer-sourced credentials to access Snowflake customer instances and bulk-export data.

Candidate safe atomics

• Enumerate databases and schemas using SHOW DATABASES / SHOW SCHEMAS
• Query INFORMATION_SCHEMA using a dedicated test role
• Run a bounded bulk-select against a synthetic test table
• Create and remove a dedicated test user or role where supported

All tests should require explicit account/database inputs, use synthetic resources, and include cleanup.

Reproducible research material

A complete synthetic scenario, timeline, baseline dataset, Sigma rule, KQL rule, and expected detection output are available here:

https://github.com/anpa1200/cloud-identity-kill-chain/tree/main/scenarios/scenario_01

The scenario uses only IANA TEST-NET addresses, fictional identities, and synthetic Snowflake telemetry.

References

• Mandiant UNC5537 reporting: https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion
• CISA AA24-207A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

I can contribute the initial Atomic YAML and validation fixtures after maintainers confirm the preferred platform identifier and technique mapping.