Detection rules › Panther

Databricks Delta Sharing Recipient Without IP ACLs

Status
Experimental
Severity
medium
Log types
Databricks.Audit
Tags
Databricks, Delta Sharing, Defense Evasion
Reference
https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Source
github.com/panther-labs/panther-analysis

Detects creation of Delta Sharing recipients without IP access list restrictions, which could allow unauthorized data access from any location.

MITRE ATT&CK coverage

TacticTechniques
StealthT1562 Impair Defenses

Rule body yaml

AnalysisType: rule
Filename: databricks_delta_sharing_recipient_without_ip_acls.py
RuleID: "Databricks.Audit.DeltaSharingRecipientWithoutIPACLs"
DisplayName: "Databricks Delta Sharing Recipient Without IP ACLs"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Delta Sharing
  - Defense Evasion
Reports:
  MITRE ATT&CK:
    - TA0005:T1562 # Impair Defenses
Severity: Medium
Description: >
  Detects creation of Delta Sharing recipients without IP access list restrictions,
  which could allow unauthorized data access from any location.
Runbook: |
  1. Query audit logs for all Delta Sharing recipient creations in the past 30 days
  2. Check if this recipient has accessed shared data in the 24 hours after creation
  3. Find all recipients without IP ACLs to establish security posture
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
  - Name: Recipient Without IP ACLs
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "createRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-partner"
      response:
        statusCode: 200
  - Name: Recipient With Empty String IP ACL
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "createRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-partner"
        ipAccessList: ""
      response:
        statusCode: 200
  - Name: Recipient With Empty List IP ACL
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "createRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-partner"
        ipAccessList: []
      response:
        statusCode: 200
  - Name: Recipient With IP ACLs Configured
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "createRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "secure-partner"
        ipAccessList: ["203.0.113.0/24", "198.51.100.0/24"]
      response:
        statusCode: 200
  - Name: Different Action Name
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "deltaSharingControl"
      actionName: "updateRecipient"
      userIdentity:
        email: "admin@example.com"
      requestParams:
        name: "external-partner"

Detection logic

Condition

actionName eq "createRecipient"
requestParams.ipAccessList is_null

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actionNameeq
  • createRecipient
requestParams.ipAccessListis_null
  • (no value, null check)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
namerequestParams.name
emailuserIdentity.email