ForceHound Maps Salesforce Permissions in BloodHound CE for Security Audits

Summary

ForceHound builds BloodHound CE graphs of Salesforce identities and permissions. The article explains API and Aura collection, empirical CRUD testing, graph integration, audit logging, and scope controls for security assessments.

Key points

ForceHound maps Salesforce users, profiles, permission sets, roles, connected apps, and sharing relationships into a BloodHound CE-compatible graph.
API mode collects detailed permission data; Aura mode can enumerate a partial graph using a browser session without API access or admin privileges.
Combined mode uses Aura for identity data and supplements it with API queries for permissions and relationships Aura cannot collect.
Optional CRUD probing tests actual create, read, edit, and, in aggressive mode, delete capabilities; aggressive testing can delete existing records.
Audit logging records Salesforce HTTP interactions. At its highest level, logs include full request and response bodies and should be treated as credential artifacts.
Scope-control flags can omit object, field, or sharing data to reduce graph size; the article says skipping object permissions can reduce output by 90% or more.
The article cites the 2025 UNC6040 campaign targeting Salesforce organizations through malicious Connected Apps as motivation for reviewing app access and permission exposure.