Detecting credential-driven attacks on Databricks

Attackers leverage stolen tokens or service principals to access the platform and mimic normal user behavior. The attack follows six stages, from initial login to data exfiltration. Detection focuses on behavioral deviations after authentication, such as unfamiliar IPs or unusual actions. Ready-to-run queries and least-privilege controls help limit damage.

Summarised from the original article by an open-source model, then checked automatically: every number and English name must appear in the source. The original article is authoritative.