TLDR Tech / InfoSec
Mapping out your unknown: A threat hunter's guide to Salesforce
Datadog's Julie Agnes Sparks analyzes the first part of the MITRE ATT&CK chain against Salesforce in the GRUB1/UNC6395 Salesloft campaign. Attackers gain initial access via OAuth phishing, compromised third-party tokens, or stolen SSO/MFA factors, then attempt brute-force retries and weak-factor swaps, locking out owners. They reuse OAuth tokens and perform discovery, hitting API limits, listing objects, and querying data to size exfiltration. Defenders should monitor Event Log Files and Real-Time Monitoring for AuraRequest calls, LoginEvent records with rare values, privileged account activities, and large queries, and correlate them by IPs, off-hours, and user agents. Queries use Datadog syntax, and the post promotes Datadog's Salesforce integration and SIEM detection rules. Other shops will need to adapt field names, and steps covered include recon through discovery, leaving collection, exfiltration, and ransom for later.
Read the full story