Detection rules › Panther

Databricks Data Downloads From Control Plane

Status
Experimental
Severity
medium
Group by
userIdentity.email
Log types
Databricks.Audit
Tags
Databricks, Exfiltration
Reference
https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Source
github.com/panther-labs/panther-analysis

Detects high volume data downloads from the control plane which may indicate data exfiltration. Monitors download actions including query results, notebooks, and models.

MITRE ATT&CK coverage

TacticTechniques
ExfiltrationT1567 Exfiltration Over Web Service

Rule body yaml

AnalysisType: rule
Filename: databricks_data_downloads_from_control_plane.py
RuleID: "Databricks.Audit.DataDownloadsFromControlPlane"
DisplayName: "Databricks Data Downloads From Control Plane"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Exfiltration
Reports:
  MITRE ATT&CK:
    - TA0010:T1567 # Exfiltration Over Web Service
Severity: Medium
Threshold: 21
DedupPeriodMinutes: 60
Description: >
  Detects high volume data downloads from the control plane which may indicate
  data exfiltration. Monitors download actions including query results, notebooks, and models.
Runbook: |
  1. Query audit logs for all download actions by this user in the past 24 hours to calculate total volume
  2. Check if the downloaded data contains sensitive classifications or PII in the 6 hours around this alert
  3. Find all users with high download rates in the past 30 days to establish baseline
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
  - Name: Preview Results Download
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "sql"
      actionName: "downloadPreviewResults"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200

SummaryAttributes:
  - actor

Detection logic

Condition

actionName in ["downloadPreviewResults", "downloadLargeResults", "filesGet", "getModelVersionDownloadUri", "getModelVersionSignedDownloadUri", "workspaceExport", "downloadQueryResult"]

This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actionNamein
  • downloadLargeResults
  • downloadPreviewResults
  • downloadQueryResult
  • filesGet
  • getModelVersionDownloadUri
  • getModelVersionSignedDownloadUri
  • workspaceExport

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
emailuserIdentity.email
actionName