Adversaries operating within the Databricks platform frequently disguise their activity using legitimate user or service-principal credentials. To evade scrutiny, attackers carry out non-linear intrusion chains, such as scoping environments with one stolen credential and returning through alternate workspaces with another. Security personnel can detect these attacks by coupling verbose audit logs with Genie to identify aberrant behaviors that manifest right after successful authentications.
Key points
Successful authentications frequently mask attacks, requiring defenders to evaluate behav…: Successful authentications frequently mask attacks, requiring defenders to evaluate behavioral patterns occurring immediately after login.
Individual actions like modifying permissions or accessing secrets only expose an attack…: Individual actions like modifying permissions or accessing secrets only expose an attack when security teams evaluate them collectively.
Organizations can uncover credential abuse by leveraging Genie alongside verbose audit lo…: Organizations can uncover credential abuse by leveraging Genie alongside verbose audit logs to spot deviations from normal operational baselines.
Sources checked by our analysis pipeline: 1
How to spot adversaries who sign in with stolen credentials, using Databricks verbose audit logs and Genie
by Solomon Boyd, Alexis Merritt, Arun Pamulapati, Sam Pezzino and David Veuve
At Databricks, we know your data is your most valuable asset. Databricks has worked with thousands of customers to securely deploy the Databricks Data + AI Platform with the appropriate features to meet their security, privacy, and regulatory requirements.
The modern cyberattack does not always begin with a shattered perimeter; it begins with a valid login. Once an adversary acquires a leaked session cookie, personal access token (PAT), or service-principal credential, the initial breach is already complete. From that moment on, their entire goal is to blend in and operate under the guise of your compromised user or service.
But having a key doesn't mean you know the building. Imagine an intruder swiping a badge to enter a secure office. They may have cleared the revolving doors, but they still have to navigate the security guard, guess which floors they have access to, and figure out where the vault is. Because…
Administrators gain hands-on control over networking and data privacy by establishing open-source environments tailored to specific project scales. Selecting the right distribution and hardening system security early prevents unauthorized access and operational downtime. Hardware choices range from repurposing older desktop machines for localized homelabs to scaling production environments through external cloud hosting providers.
Veteran financial services technologist Alasdair Anderson is leveraging his twenty years of customer-side experience to modernize core enterprise operations at Databricks. Working directly with executive boards, he develops advanced platforms to tackle intricate challenges across compliance, credit, and market risk. This hands-on advisory work helps institutions navigate volatile markets by executing complex machine learning workloads safely.
Over 600 undersea systems form the vital mesh carrying petabytes of global internet traffic, including live communications and critical uncacheable data. However, the sector is navigating compounding threats from maritime accidents, geopolitical sabotage, and shared geological fault lines that endanger concentrated transit bottlenecks. Meanwhile, private-sector capital is rapidly displacing legacy telecommunications funding, raising questions about control over international data pathways.