Databricks Data Movement with Explicit Credentials

AnalysisType: rule
Filename: databricks_data_movement_explicit_credentials.py
RuleID: "Databricks.Audit.DataMovementExplicitCredentials"
DisplayName: "Databricks Data Movement with Explicit Credentials"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Exfiltration
Reports:
  MITRE ATT&CK:
    - TA0010:T1537 # Transfer Data to Cloud Account
Severity: Info
Description: >
  Detects creation or modification of storage credentials, connections, and external
  locations that could facilitate data exfiltration. These operations establish direct
  paths to external storage and may indicate data movement preparation. Mount point
  creation is covered separately by Databricks.Audit.MountPointCreation.
Runbook: |
  1. Verify the credential/connection creation was part of an approved workflow
  2. Check the target storage location for sensitivity
  3. Monitor for subsequent data access through the new credential
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/tree/main/base/detections/behavioral
Tests:
  - Name: Storage Credential Created
    ExpectedResult: true
    Log:
      serviceName: "unityCatalog"
      actionName: "createStorageCredential"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-s3-cred"
      response:
        statusCode: 200

  - Name: Connection Updated
    ExpectedResult: true
    Log:
      serviceName: "unityCatalog"
      actionName: "updateConnection"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "snowflake-conn"
      response:
        statusCode: 200

  - Name: Mount Action - Excluded (covered by separate rule)
    ExpectedResult: false
    Log:
      serviceName: "dbfs"
      actionName: "mount"
      userIdentity:
        email: "user@example.com"
      requestParams:
        mountPoint: "/mnt/data"

  - Name: Different Action - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "unityCatalog"
      actionName: "getStorageCredential"
      userIdentity:
        email: "user@example.com"


# ------ paired body: databricks_data_movement_explicit_credentials.py ------

from panther_databricks_helpers import DATA_MOVEMENT_CREDENTIAL_ACTIONS, databricks_alert_context


def rule(event):
    action = event.get("actionName")
    # mount is covered by databricks_mount_point_creation; skip it here
    return action in DATA_MOVEMENT_CREDENTIAL_ACTIONS and action != "mount"


def title(event):
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    action = event.get("actionName", "unknown")
    workspace = event.get("workspaceId", "Unknown Workspace")
    return f"Data movement credential operation: {action} in workspace {workspace} by {actor}"


def dedup(event):
    actor = event.deep_get("userIdentity", "email", default="unknown")
    action = event.get("actionName", "unknown")
    return f"data_movement_cred_{actor}_{action}"


def alert_context(event):
    return databricks_alert_context(
        event,
        additional_fields={
            "request_params": event.get("requestParams"),
        },
    )