Detection rules › Panther

Databricks Destructive Activities

Status
Experimental
Severity
medium
Group by
userIdentity.email
Log types
Databricks.Audit
Tags
Databricks, Impact
Reference
https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Source
github.com/panther-labs/panther-analysis

Detects high volume destructive activities by a single user which may indicate malicious data destruction, ransomware, or insider threats.

MITRE ATT&CK coverage

TacticTechniques
ImpactT1485 Data Destruction

Rule body yaml

AnalysisType: rule
Filename: databricks_destructive_activities.py
RuleID: "Databricks.Audit.DestructiveActivities"
DisplayName: "Databricks Destructive Activities"
Enabled: true
Status: Experimental
LogTypes:
  - Databricks.Audit
Tags:
  - Databricks
  - Impact
Reports:
  MITRE ATT&CK:
    - TA0040:T1485 # Data Destruction
Severity: Medium
Threshold: 50
DedupPeriodMinutes: 1440
Description: >
  Detects high volume destructive activities by a single user which may indicate
  malicious data destruction, ransomware, or insider threats.
Runbook: |
  1. Query audit logs for all delete actions by this user in the past 7 days to identify patterns
  2. Check if deleted resources can be recovered or if backups exist
  3. Find all users with high deletion rates in the past 30 days to establish baseline
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
Tests:
  - Name: Delete Table
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "unityCatalog"
      actionName: "deleteTable"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200
  - Name: Drop Schema
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "unityCatalog"
      actionName: "dropSchema"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200
  - Name: Trash Notebook
    ExpectedResult: true
    Log:
      timestamp: 1704067200000
      serviceName: "workspace"
      actionName: "trashNotebook"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200
  - Name: Undelete Should Not Alert
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "unityCatalog"
      actionName: "undeleteTable"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200
  - Name: System User Should Not Alert
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "unityCatalog"
      actionName: "deleteTable"
      userIdentity:
        email: "System-User"
      response:
        statusCode: 200
  - Name: Non-Destructive Action
    ExpectedResult: false
    Log:
      timestamp: 1704067200000
      serviceName: "unityCatalog"
      actionName: "createTable"
      userIdentity:
        email: "user@example.com"
      response:
        statusCode: 200
SummaryAttributes:
  - actor

Detection logic

Condition

userIdentity.email not in "System-User"
not (actionName starts_with "undelete" or actionName starts_with "restore")
actionName starts_with "delete" or actionName starts_with "drop" or actionName starts_with "trash" or actionName starts_with "destroy" or actionName starts_with "purge"

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
actionNamestarts_withrestore
actionNamestarts_withundelete
userIdentity.emaileqSystem-User

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actionNamestarts_with
  • delete
  • destroy
  • drop
  • purge
  • trash

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
emailuserIdentity.email
actionName