Detecting credential-driven attacks on Databricks

Databricks describes how credential-driven attacks unfold on its platform in six non-linear stages—initial access with valid credentials, environment mapping, credential harvesting, execution via UDFs and jobs, persistence, and data collection with cleanup—and what to look for in verbose audit logs at each stage. The post explains how to investigate these attacks with Genie and the Detection App, how to respond once a compromise is confirmed, and which preventive controls such as context-based ingress, least privilege, and credential rotation limit what a stolen credential can do.