Mapping out your unknown: A threat hunter’s guide to Salesforce

Threat actors are targeting Salesforce environments by exploiting compromised credentials, OAuth tokens, and misconfigured guest accounts to gain unauthorized access. They perform reconnaissance by querying API endpoints to enumerate resources, discover data objects, and assess API usage limits. This activity is often followed by data enumeration and potential exfiltration, leveraging legitimate authentication mechanisms to blend in with normal traffic. Attackers may use brute-force techniques against weak MFA methods or socially engineer users to approve malicious connected apps.

AI-extracted · verify before operational use