Databricks MFA Key Change

AnalysisType: rule
Filename: databricks_mfa_key_change.py
RuleID: "Databricks.Audit.MFAKeyChange"
DisplayName: "Databricks MFA Key Change"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Credential Access
Reports:
  MITRE ATT&CK:
    - TA0006:T1556 # Modify Authentication Process
Severity: Info
Description: >
  Detects addition or deletion of MFA keys on Databricks accounts. MFA key deletion
  may indicate an attacker weakening account security, while unexpected additions may
  indicate enrollment of attacker-controlled authenticators.
Runbook: |
  1. Verify the actor intended to modify their MFA settings
  2. For deletions, check if a replacement key was added
  3. For additions, verify the new key was enrolled by the legitimate user
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/tree/main/base/detections/behavioral
Tests:
  - Name: MFA Key Added
    ExpectedResult: true
    Log:
      serviceName: "accounts"
      actionName: "mfaAddKey"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200

  - Name: MFA Key Deleted
    ExpectedResult: true
    Log:
      serviceName: "accounts"
      actionName: "mfaDeleteKey"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200

  - Name: Different Service - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "workspace"
      actionName: "mfaAddKey"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200

  - Name: Different Action - Should Not Alert
    ExpectedResult: false
    Log:
      serviceName: "accounts"
      actionName: "login"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200


# ------ paired body: databricks_mfa_key_change.py ------

from panther_databricks_helpers import MFA_ACTIONS, databricks_alert_context


def rule(event):
    if event.get("serviceName") != "accounts":
        return False

    action = event.get("actionName")
    return action in MFA_ACTIONS["add"] or action in MFA_ACTIONS["delete"]


def title(event):
    action = event.get("actionName", "unknown")
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    change_type = "added" if action in MFA_ACTIONS["add"] else "deleted"
    return f"MFA key {change_type} by {actor}"


def dedup(event):
    actor = event.deep_get("userIdentity", "email", default="unknown")
    action = event.get("actionName", "unknown")
    return f"mfa_key_change_{actor}_{action}"


def alert_context(event):
    return databricks_alert_context(
        event,
        additional_fields={
            "change_type": "add" if event.get("actionName") in MFA_ACTIONS["add"] else "delete",
        },
    )