Datadog Shares Threat-Hunting Queries for Detecting Suspicious Salesforce Activity
Summary
Datadog provides Salesforce log queries and guidance to help security teams hunt for suspicious access, weak-MFA login attempts, OAuth token misuse, and API reconnaissance that may precede data exfiltration.
Key points
- The guide maps Salesforce attacker behaviors to MITRE ATT&CK and covers reconnaissance through discovery.
- It explains how compromised accounts, malicious connected apps, stolen SSO credentials, and MFA-code theft can lead to Salesforce access.
- Queries for Event Log Files and Real-Time Event Monitoring can help identify suspicious guest-user activity and failed login or MFA attempts.
- OAuth login guidance highlights unfamiliar connected apps, unusual IP addresses, and API activity following successful logins.
- API queries can flag requests for tenant limits, lists of objects, and counts of sensitive records that may indicate preparation for data collection.
- Datadog recommends reviewing associated users, IPs, applications, and subsequent API events, then turning useful queries into detection rules.
Article Details
- Defense Focus
- Hunt for suspicious Salesforce reconnaissance, account access, credential attacks, OAuth token use, and discovery activity using Salesforce audit data.
- Detection Methods
- Detect Aura Request events that access Salesforce Communities and Sites configuration paths, then review subsequent API activity by the same user or IP address.
- Alert on successful logins or API activity involving Guest user accounts and investigate access to sensitive objects or broad queries.
- Look for spikes in failed logins and denied or failed MFA verification attempts, including sequences of failed attempts followed by a successful login.
- Monitor changes to email addresses, phone numbers, and MFA options, particularly for privileged accounts; correlate identity-provider logs when MFA is managed externally.
- Review successful OAuth logins for new or rare applications, unusual IP addresses or geolocations, and subsequent enumeration or extraction activity.
- Hunt for queries to LimitSnapshot, requests listing tenant objects, and broad count queries against sensitive entities; examine subsequent API activity for possible collection or exfiltration.
- Data Sources
- Salesforce Event Log Files (ELF), including Login, RestApi, URI, and related event records
- Salesforce Real-Time Event Monitoring (RTEM), including LoginEvent, ApiEvent, IdentityVerificationEvent, and AuraRequest events
- Salesforce Unique Query events and SOQL query content where available
- Identity-provider audit logs for Salesforce-targeted authentication events
- Geolocation-enriched SIEM data, where available
- Rule Types
- Datadog log-search queries
- Salesforce SOQL query patterns
- Platforms
- Salesforce
- Datadog Cloud SIEM
- Defensive Actions
- Review associated users, user types, source IP addresses, user agents, applications, and clients, and determine whether the activity is expected.
- Correlate suspicious logins with subsequent API events using the user, IP address, login or session key, and available application details.
- Investigate unfamiliar OAuth applications, unexpected proxy or VPN use, and anomalous IP addresses against known user behavior.
- Adjust failed-login thresholds to fit the organization’s environment and investigate successful logins following repeated failures.
- Review broad queries and large responses for sensitive-object access or evidence of collection before exfiltration.
- Convert useful hunting queries into detection rules and ensure relevant ELF, RTEM, and identity-provider logs are available.
MITRE ATT&CK
T1078 · Valid AccountsThe article maps Salesforce configuration requests and successful Guest-user logins to Valid Accounts behavior.T1110 · Brute ForceThe article maps repeated failed Salesforce login attempts and failed weak-MFA verification attempts to brute-force activity.T1528 · Steal Application Access TokenThe article maps successful Salesforce OAuth logins and suspected use of compromised OAuth access tokens to this technique.T1619 · Cloud Storage Object DiscoveryThe article maps Salesforce queries for LimitSnapshot, tenant object listings, and sensitive-object counts to discovery of available data.
Vendors
DatadogDatadog’s Security Research team has analyzed current Salesforce threats, logging, and detection opportunities.SalesforceSalesforce is one of the world’s most widely adopted SaaS platforms, embedded deep into the operational and data pipelines of modern organizations to better serve customers and understand their business health.
Products
Datadog Cloud SIEMUse Datadog's Salesforce integration to ingest Event Log Files and Real-Time Event Monitoring data directly into Datadog Cloud SIEM.SalesforceSalesforce is one of the world’s most widely adopted SaaS platforms, embedded deep into the operational and data pipelines of modern organizations to better serve customers and understand their business health.