Browse Rules

[SALESFORCE] CredentialStuffingEvent event detected

[SALESFORCE] CredentialStuffingEvent event detected

[SALESFORCE] PermissionSetEvent event detected

[SALESFORCE] PermissionSetEvent event detected

[SALESFORCE] Login After Brute Force

[SALESFORCE] Login After Brute Force

[SALESFORCE] Session Hijacking Event Detected

[SALESFORCE] Session Hijacking Event Detected

[DYNAMIC] Salesforce logs detected via program.

[DYNAMIC] Salesforce logs detected via program.

[SALESFORCE] Failed Identity Verification Event Detected

[SALESFORCE] Failed Identity Verification Event Detected

[SALESFORCE] Login as Org Admin Detected

[SALESFORCE] Login as Org Admin Detected

[SALESFORCE] Anomalous Export Event Detected - Possible Exfil

[SALESFORCE] Anomalous Export Event Detected - Possible Exfil

Salesforce Admin Login As User

Salesforce detection that alerts when an admin logs in as another user.

[SALESFORCE] Anomalous API Activity from a User Detected

[SALESFORCE] Anomalous API Activity from a User Detected

[SALESFORCE] File Action was Blocked for a User

[SALESFORCE] File Action was Blocked for a User

[SALESFORCE] Suspicious IP Detected via Bluedot - Successful Login

[SALESFORCE] Suspicious IP Detected via Bluedot - Successful Login

[SALESFORCE] File Policy Violation not Blocked for Exempt User

[SALESFORCE] File Policy Violation not Blocked for Exempt User

[SALESFORCE] Possible Brute Force Failed Login Attempts [25/1]

[SALESFORCE] Possible Brute Force Failed Login Attempts [25/1]

Salesforce infrastructure abuse

Identifies messages that resemble credential theft, originating from Salesforce. Salesforce infrastrcture abuse has been observed recently to send phishing attacks.

Salesforce API Anomaly Detection (RET Passthrough)

Salesforce Real-Time Event Monitoring has detected anomalous API activity. This could indicate compromised credentials, automated abuse, data exfiltration attempts, or other suspicious API usage patterns.

Impersonation: Salesforce fake campaign failure notification

Detects messages impersonating Salesforce with urgent language about failed or cancelled campaigns, containing external links from first-time senders outside legitimate Salesforce domains.

Salesforce Bulk API Data Exfiltration

Detects Salesforce Bulk API operations that could indicate data exfiltration attempts. The Bulk API allows users to process large volumes of records (up to millions) asynchronously, making it a common vector for data theft. This detection triggers on all Bulk API job completions and adjusts severity based on: - Operation type (query operations are highest risk for exfiltration) - Volume of records processed - Entity/object type being accessed

Spam: Personalized subject and greetings via Salesforce Marketing Cloud

Detects messages sent through Salesforce Marketing Cloud infrastructure that contain a fake previous email thread, where both the current and previous threads start with the same greeting pattern extracted from the subject line.

Salesforce OAuth Credential Abuse Detection

Detects OAuth credential abuse and suspicious token usage patterns in Salesforce. OAuth tokens provide API access and can be abused if compromised, making this detection critical for: - Stolen or leaked OAuth tokens - Token replay attacks - Excessive API usage indicating automated abuse - Failed token refresh attempts (potential brute force) - Unauthorized token revocations This detection triggers on OAuth-related security events and adjusts severity based on: - Token revocation events (may ind

Salesforce Third-Party Integration Monitoring

Monitors third-party integrations and OAuth connected apps accessing Salesforce. Connected apps use OAuth for authorization and can access data on behalf of users, making them a potential vector for: - Unauthorized data access - Shadow IT applications - Compromised OAuth tokens - Over-privileged integrations This detection triggers on connected app usage events and adjusts severity based on: - Connection type (refresh tokens are higher risk) - App authorization events - Suspicious app naming pa

Google Notification alert link from non-Google sender

This rule detects messages that leverage a link to notifications.google.com not from google and from an untrusted sender. Commonly abused in salesforce phishing campaigns.

Service Abuse: ExactTarget with suspicious sender indicators

Message originates from ExactTarget infrastructure but uses a suspicious sender domain, including overly long salesforce.com domains, awsapps.com domains, domains containing UTF-8 encoding characters, or a suspicious sender display name.

Service abuse: Recruiting with suspicious language patterns from legitimate platforms

Detects suspicious recruiting messages from legitimate services like Salesforce, LADesk, or AWS Apps with unusually long sender email addresses and recruiting-specific language patterns that may indicate abuse of trusted platforms for social engineering.

Activity Performed by Terminated User

Detects when a Microsoft Cloud App Security reported for users whose account were terminated in Azure AD, but still perform activities in other platforms such as AWS or Salesforce. This is especially relevant for users who use another account to manage resources, since these accounts are often not terminated when a user leaves the company.