Databricks Workspace Admin Privileged Role Assignment

Description

Detects when workspace-level admin privileges are granted in Databricks through direct role assignments or administrative group membership. This simplified version detects direct admin grants and additions to admin groups. For nested group resolution (detecting when groups are added to admin groups), consider implementing a correlation rule. Successful grants to the system 'admins' group are elevated to HIGH severity.

Query · python

from panther_databricks_helpers import (
    databricks_alert_context,
    extract_group_identifier,
    extract_target_principal,
    get_principal_type,
    is_admin_privilege_action,
)

REMOVAL_ACTIONS = ["removeAdmin", "removePrincipalFromGroup"]


def rule(event):
    # Only match workspace-level events to avoid overlap with the
    # account-level admin privilege rule
    if event.get("auditLevel") != "WORKSPACE_LEVEL":
        return False

    # Exclude privilege removals — this rule detects grants only
    if event.get("actionName") in REMOVAL_ACTIONS:
        return False

    return is_admin_privilege_action(event)


def severity(event):
    status_code = event.deep_get("response", "statusCode")
    return "HIGH" if status_code == 200 else "MEDIUM"


def title(event):
    action = event.get("actionName", "Unknown Action")
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    target = extract_target_principal(event) or "Unknown Principal"
    workspace = event.get("workspaceId", "Unknown Workspace")
    status_code = event.deep_get("response", "statusCode")
    status = "Granted" if status_code == 200 else "Attempted to grant"

    # Check if it's direct admin action or group-based
    if action in ["setAdmin", "addAdmin"]:
        return (
            f"{status} workspace admin privileges to {target}"
            f" in workspace {workspace} by {actor}"
        )
    group = extract_group_identifier(event)
    return (
        f"{status} admin group membership ({group}) to {target}"
        f" in workspace {workspace} by {actor}"
    )


def dedup(event):
    target_principal = extract_target_principal(event) or "unknown"
    workspace = event.get("workspaceId", "unknown")
    return f"workspace_admin_privilege_{workspace}_{target_principal}"


def alert_context(event):
    target_principal = extract_target_principal(event)
    principal_type = get_principal_type(target_principal) if target_principal else "Unknown"
    group = extract_group_identifier(event)

    return databricks_alert_context(
        event,
        additional_fields={
            "privilege_scope": "WORKSPACE_LEVEL",
            "target_principal": target_principal,
            "principal_type": principal_type,
            "target_group": group,
            "is_system_admins_group": group.lower() == "admins" if group else False,
            "detection_note": (
                "Direct grants only - nested group resolution requires correlation rule"
            ),
        },
    )

Analyst notes

  1. Query audit logs for all workspace administrative actions by the target principal in the 24 hours after this privilege grant
  2. Check if the target principal created clusters, modified notebooks, or accessed sensitive data in the 6 hours after receiving admin rights
  3. Find all workspace admin grants for this workspace in the past 90 days to establish baseline
Raw source Databricks Workspace Admin Privileged Role Assignment · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: databricks_workspace_admin_privileged_role_assignment.py
RuleID: "Databricks.Audit.WorkspaceAdminPrivilegedRoleAssignment"
DisplayName: "Databricks Workspace Admin Privileged Role Assignment"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Privilege Escalation
  - Persistence
Reports:
  MITRE ATT&CK:
    - TA0004:T1098 # Account Manipulation
    - TA0003:T1136 # Create Account
Severity: Medium
Description: >
  Detects when workspace-level admin privileges are granted in Databricks through direct role
  assignments or administrative group membership. This simplified version detects direct admin
  grants and additions to admin groups. For nested group resolution (detecting when groups are
  added to admin groups), consider implementing a correlation rule. Successful grants to the
  system 'admins' group are elevated to HIGH severity.
Runbook: |
  1. Query audit logs for all workspace administrative actions by the target principal in the 24 hours after this privilege grant
  2. Check if the target principal created clusters, modified notebooks, or accessed sensitive data in the 6 hours after receiving admin rights
  3. Find all workspace admin grants for this workspace in the past 90 days to establish baseline
Reference: https://github.com/databricks-solutions/cybersec-workspace-detection-app/blob/main/base/detections/event-based/workspace_admin_privileged_role_assignment.py
SummaryAttributes:
  - actor
  - target_principal
  - principal_type
  - target_group
Tests:
  - Name: Direct Workspace Admin Grant
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "accounts"
      actionName: "setAdmin"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      sourceIPAddress: "198.51.100.1"
      requestParams:
        targetUserName: "newadmin@example.com"
      response:
        statusCode: 200
  - Name: Add to System Admins Group
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "accounts"
      actionName: "addPrincipalToGroup"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        principal: "user@example.com"
        targetGroupName: "admins"
      response:
        statusCode: 200
  - Name: Add to Workspace Admins Group
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "accounts"
      actionName: "addPrincipalsToGroup"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        targetUserName: "user@example.com"
        targetGroupName: "workspace-admins"
      response:
        statusCode: 200
  - Name: Service Principal Admin Grant
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "accounts"
      actionName: "addPrincipalToGroup"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        principal: "12345678-1234-1234-1234-123456789012"
        targetGroupName: "workspace-administrators"
      response:
        statusCode: 200
  - Name: Account-Level Event Should Not Alert
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      auditLevel: "ACCOUNT_LEVEL"
      serviceName: "accounts"
      actionName: "setAccountAdmin"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        targetUserName: "user@example.com"
      response:
        statusCode: 200
  - Name: Failed Admin Grant
    ExpectedResult: true
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "accounts"
      actionName: "setAdmin"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "attacker@example.com"
      requestParams:
        targetUserName: "attacker@example.com"
      response:
        statusCode: 403
  - Name: Remove Admin Should Not Alert
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "accounts"
      actionName: "removeAdmin"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        targetUserName: "user@example.com"
      response:
        statusCode: 200
  - Name: Remove From Admin Group Should Not Alert
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "accounts"
      actionName: "removePrincipalFromGroup"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        principal: "user@example.com"
        targetGroupName: "admins"
      response:
        statusCode: 200
  - Name: Account-Level Without Workspace Context
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      auditLevel: "ACCOUNT_LEVEL"
      serviceName: "accounts"
      actionName: "setAdmin"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        targetUserName: "user@example.com"
  - Name: Non-Admin Group
    ExpectedResult: false
    Log:
      timestamp: 1234567890000
      auditLevel: "WORKSPACE_LEVEL"
      serviceName: "accounts"
      actionName: "addPrincipalToGroup"
      workspaceId: "1234567890123456"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        principal: "user@example.com"
        targetGroupName: "data-engineers"


# ------ paired body: databricks_workspace_admin_privileged_role_assignment.py ------

from panther_databricks_helpers import (
    databricks_alert_context,
    extract_group_identifier,
    extract_target_principal,
    get_principal_type,
    is_admin_privilege_action,
)

REMOVAL_ACTIONS = ["removeAdmin", "removePrincipalFromGroup"]


def rule(event):
    # Only match workspace-level events to avoid overlap with the
    # account-level admin privilege rule
    if event.get("auditLevel") != "WORKSPACE_LEVEL":
        return False

    # Exclude privilege removals — this rule detects grants only
    if event.get("actionName") in REMOVAL_ACTIONS:
        return False

    return is_admin_privilege_action(event)


def severity(event):
    status_code = event.deep_get("response", "statusCode")
    return "HIGH" if status_code == 200 else "MEDIUM"


def title(event):
    action = event.get("actionName", "Unknown Action")
    actor = event.deep_get("userIdentity", "email", default="Unknown Actor")
    target = extract_target_principal(event) or "Unknown Principal"
    workspace = event.get("workspaceId", "Unknown Workspace")
    status_code = event.deep_get("response", "statusCode")
    status = "Granted" if status_code == 200 else "Attempted to grant"

    # Check if it's direct admin action or group-based
    if action in ["setAdmin", "addAdmin"]:
        return (
            f"{status} workspace admin privileges to {target}"
            f" in workspace {workspace} by {actor}"
        )
    group = extract_group_identifier(event)
    return (
        f"{status} admin group membership ({group}) to {target}"
        f" in workspace {workspace} by {actor}"
    )


def dedup(event):
    target_principal = extract_target_principal(event) or "unknown"
    workspace = event.get("workspaceId", "unknown")
    return f"workspace_admin_privilege_{workspace}_{target_principal}"


def alert_context(event):
    target_principal = extract_target_principal(event)
    principal_type = get_principal_type(target_principal) if target_principal else "Unknown"
    group = extract_group_identifier(event)

    return databricks_alert_context(
        event,
        additional_fields={
            "privilege_scope": "WORKSPACE_LEVEL",
            "target_principal": target_principal,
            "principal_type": principal_type,
            "target_group": group,
            "is_system_admins_group": group.lower() == "admins" if group else False,
            "detection_note": (
                "Direct grants only - nested group resolution requires correlation rule"
            ),
        },
    )

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.