# Databricks explains how to detect credential-driven attacks on its platform

> Original title: Detecting credential-driven attacks on Databricks

- Source: Databricks Blog
- Published: 2026-11-11T23:00:00.000Z
- Bad Influence: https://badinfluence.news/items/id5bkvv4lt65lw7tqmsney22n
- Original: https://www.databricks.com/blog/detecting-credential-driven-attacks-databricks

## Summary

Databricks explains how a credential-driven attack unfolds on its platform, after an attacker gains access with a stolen session cookie, personal access token, or service-principal credential. The post describes using verbose audit logs and Genie to detect shifts in an identity's behavior, how to respond after confirming a compromise, and which controls limit what a stolen credential can do.