Databricks Publishes Guide to Detecting Credential-Driven Attacks

Databricks published a guide on detecting credential-driven attacks on its platform, describing how attacks unfold after a stolen personal access token, session cookie or service-principal credential is used, and how verbose audit logs plus its Genie assistant can spot the behavioral shift. The post maps adversary activity into six stages, from initial login through environment reconnaissance, and covers response steps and controls that limit what a stolen credential can reach. To use it, customers install the Detection App, which adds a Genie agent for Databricks' audit logging; Databricks says the agent includes more than 30 detections, ranging from token misuse to admin grants. The guide also cautions that an empty result doesn't mean nothing happened, and that audit logs record that something changed and who changed it but often not the old or new values.

Generated from reports · updated 12 h ago

Not enough continuous observations yet to draw a trend.