Detection rules › Panther
Databricks Long-Lifetime Token Generated
Detects generation of personal access tokens (PATs) with lifetime exceeding 72 hours. Long-lived tokens increase the risk of credential theft and unauthorized access if compromised. Tokens with lifetime >90 days are elevated to MEDIUM, >1 year to HIGH severity.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation |
| Lateral Movement | T1550 Use Alternate Authentication Material |
Rule body yaml
AnalysisType: rule
Filename: databricks_long_lifetime_token_generated.py
RuleID: "Databricks.Audit.LongLifetimeTokenGenerated"
DisplayName: "Databricks Long-Lifetime Token Generated"
Enabled: true
Status: Experimental
LogTypes:
- Databricks.Audit
Tags:
- Databricks
- Credential Access
- Persistence
Reports:
MITRE ATT&CK:
- TA0006:T1550 # Use Alternate Authentication Material
- TA0003:T1098 # Account Manipulation
Severity: Low
Description: >
Detects generation of personal access tokens (PATs) with lifetime exceeding 72 hours.
Long-lived tokens increase the risk of credential theft and unauthorized access if compromised.
Tokens with lifetime >90 days are elevated to MEDIUM, >1 year to HIGH severity.
Runbook: |
1. Query audit logs for all token generation by this user in the past 30 days to identify patterns
2. Check if the generated token has been used for API calls in the 24 hours after creation
3. Find all other long-lifetime tokens (>72 hours) created in the past 90 days to establish baseline
Reference: https://github.com/andyweaves/system-tables-audit-logs/blob/main/resources/queries_and_alerts.json
SummaryAttributes:
- actor
- token_duration_days
Tests:
- Name: Token with 7 Day Lifetime
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "accounts"
actionName: "generateDbToken"
workspaceId: "1234567890123456"
userIdentity:
email: "user@example.com"
sourceIPAddress: "198.51.100.1"
requestParams:
tokenExpirationTime: "1704672000000"
tokenHash: "abc123def456"
response:
statusCode: 200
- Name: Token with 100 Day Lifetime (MEDIUM)
ExpectedResult: true
Log:
timestamp: 1704067200000
serviceName: "accounts"
actionName: "generateDbToken"
userIdentity:
email: "admin@example.com"
requestParams:
tokenExpirationTime: "1712707200000"
tokenHash: "xyz789"
response:
statusCode: 200
- Name: Token with 24 Hour Lifetime
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "accounts"
actionName: "generateDbToken"
userIdentity:
email: "user@example.com"
requestParams:
tokenExpirationTime: "1704153600000"
tokenHash: "short123"
- Name: Different Action
ExpectedResult: false
Log:
timestamp: 1704067200000
serviceName: "accounts"
actionName: "revokeDbToken"
userIdentity:
email: "user@example.com"
Detection logic
Condition
actionName eq "generateDbToken"
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
actionName | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
email | userIdentity.email |