Detection rules › Panther
Databricks Destructive Activities
Detects high volume destructive activities by a single user which may indicate malicious data destruction, ransomware, or insider threats.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Impact | T1485 Data Destruction |
Rule body yaml
AnalysisType: rule
Filename: databricks_destructive_activities.py
RuleID: "Databricks.Audit.DestructiveActivities"
DisplayName: "Databricks Destructive Activities"
Enabled: true
Status: Experimental
LogTypes:
- Databricks.Audit
Tags:
- Databricks
- Impact
Reports:
MITRE ATT&CK:
- TA0040:T1485 # Data Destruction
Severity: Medium
Threshold: 50
DedupPeriodMinutes: 1440
Description: >
Detects high volume destructive activities by a single user which may indicate
malicious data destruction, ransomware, or insider threats.
Runbook: |
1. Query audit logs for all delete actions by this user in the past 7 days to identify patterns
2. Check if deleted resources can be recovered or if backups exist
3. Find all users with high deletion rates in the past 30 days to establish baseline
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
- Name: Delete Table
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "unityCatalog"
actionName: "deleteTable"
userIdentity:
email: "user@example.com"
response:
statusCode: 200
- Name: Drop Schema
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "unityCatalog"
actionName: "dropSchema"
userIdentity:
email: "user@example.com"
response:
statusCode: 200
- Name: Trash Notebook
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "workspace"
actionName: "trashNotebook"
userIdentity:
email: "user@example.com"
response:
statusCode: 200
- Name: Undelete Should Not Alert
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "unityCatalog"
actionName: "undeleteTable"
userIdentity:
email: "user@example.com"
response:
statusCode: 200
- Name: System User Should Not Alert
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "unityCatalog"
actionName: "deleteTable"
userIdentity:
email: "System-User"
response:
statusCode: 200
- Name: Non-Destructive Action
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "unityCatalog"
actionName: "createTable"
userIdentity:
email: "user@example.com"
response:
statusCode: 200
SummaryAttributes:
- actor
Detection logic
Condition
userIdentity.email not in "System-User"
not (actionName starts_with "undelete" or actionName starts_with "restore")
actionName starts_with "delete" or actionName starts_with "drop" or actionName starts_with "trash" or actionName starts_with "destroy" or actionName starts_with "purge"
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
actionName | starts_with | restore |
actionName | starts_with | undelete |
userIdentity.email | eq | System-User |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
actionName | starts_with |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
email | userIdentity.email |
actionName |