Salesforce
Telemetry Evidence
These values show how indexed rules identify Salesforce telemetry.Kusto
SalesforceServiceCloud Panther
Salesforce.LoginAs Salesforce.RealtimeEvent salesforce
Detection Rules
Kusto #
- Brute force attack against user credentials source medium: 'Identifies evidence of brute force activity against a user based on multiple authentication failures and at least one successful authentication within a given time window. This query limits IPAddresses to 100 and may not potentially cover all IPAddresses. The default failure threshold is 10, success threshold is 1, and the default time window is 20 minutes.'
T1110 - Potential Password Spray Attack source medium: 'This query searches for failed attempts to log in from more than 15 various users within a 5 minutes timeframe from the same source. This is a potential indication of a password spray attack.'
T1110 - User Sign in from different countries source medium: 'This query searches for successful user logins from different countries within 30 mins.'
T1078
Panther #
- Salesforce Admin Login As User source informational: Salesforce detection that alerts when an admin logs in as another user.
- Salesforce API Anomaly Detection (RET Passthrough) source medium: Salesforce Real-Time Event Monitoring has detected anomalous API activity. This could indicate compromised credentials, automated abuse, data exfiltration attempts, or other suspicious API usage patterns.
T1078,T1110,T1530,T1567 - Salesforce Bulk API Data Exfiltration source medium: Detects Salesforce Bulk API operations that could indicate data exfiltration attempts. The Bulk API allows users to process large volumes of records (up to millions) asynchronously, making it a common vector for data theft. This detection triggers on all Bulk API job completions and adjusts severity based on: - Operation type (query operations are highest risk for exfiltration) - Volume of records processed - Entity/object type being accessed
T1020,T1530,T1567 - Salesforce OAuth Credential Abuse Detection source medium: Detects OAuth credential abuse and suspicious token usage patterns in Salesforce. OAuth tokens provide API access and can be abused if compromised, making this detection critical for: - Stolen or leaked OAuth tokens - Token replay attacks - Excessive API usage indicating automated abuse - Failed token refresh attempts (potential brute force) - Unauthorized token revocations This detection triggers on OAuth-related security events and adjusts severity based on: - Token revocation events (may indicate compromise response) - Failed OAuth operations (potential attack attempts) - Excessive API usage patterns
T1020,T1110,T1528,T1550 - Salesforce Third-Party Integration Monitoring source medium: Monitors third-party integrations and OAuth connected apps accessing Salesforce. Connected apps use OAuth for authorization and can access data on behalf of users, making them a potential vector for: - Unauthorized data access - Shadow IT applications - Compromised OAuth tokens - Over-privileged integrations This detection triggers on connected app usage events and adjusts severity based on: - Connection type (refresh tokens are higher risk) - App authorization events - Suspicious app naming patterns
T1098,T1199,T1528,T1550