Detecting credential-driven attacks on Databricks with verbose audit logs and Genie

Databricks details how credential-driven attacks unfold on its platform and how verbose audit logs plus Genie can detect the behavioral shift after a stolen PAT, session cookie, or service-principal credential is used. The post maps adversary activity into six stages, from initial login through environment reconnaissance, and covers response steps and controls that limit what a stolen credential can reach.