Salesforce #
Salesforce IR is less common and consistently under-covered. In 2024-25 UNC6040 / Scattered Spider / ShinyHunters campaigns heavily targeted Salesforce via voice phishing → Data Loader OAuth consent → bulk CRM export. Many orgs don't license Event Monitoring, so confirm what logging exists before you commit to answering scoping questions.
Log sources
| Source | Access | What it covers |
|---|---|---|
| Setup Audit Trail | Setup → Security → View Setup Audit Trail; CSV export | Config changes: profile/permission set edits, connected app creation, IP allowlist, trusted IP ranges, SSO config. 6 months default, downloadable, limited search. ts: CreatedDate UTC (ISO-8601 with ms) stamped at config-change commit. |
| Login History | Setup → Users → Login History | User logins, source IP, status, browser, platform, API vs UI, Login Type (OAuth, SAML, Partner, etc.) - 6 months. ts: LoginTime UTC (ms). Includes SessionKey you can join to EventLogFile LoginEvent for the richer record. |
| Event Monitoring | Requires Shield add-on OR included in Enterprise+ with certain limits | Fine-grained event log files: Login, LoginAs, API, RestApi, ReportExport, BulkApi2, DataExport, URI, LightningPageView, ApexExecution, ContentDocumentLink, ListViewEvent. Hourly files via EventLogFile SOQL. Export via API quickly - short retention (30d typical). ts: each row in a log file has TIMESTAMP + TIMESTAMP_DERIVED (both UTC, ISO-8601 ms). The EventLogFile object itself has LogDate (daily partition) and Interval (Hourly or Daily). Hourly files are published ~3-6 h after the hour closes; Daily ~24 h after midnight - there's always a delivery lag you must plan around. |
| Field Audit Trail | Shield add-on | Up to 10yr field history retention. ts: each FieldHistoryArchive row has FieldHistoryType + CreatedDate UTC. |
| Real-Time Event Monitoring + Transaction Security | Shield add-on | Streaming events, policy-based block/alert - ApiAnomalyEvent, ReportAnomalyEvent, SessionHijackingEvent, CredentialStuffingEvent, GuestUserAnomalyEvent. ts: delivered as CometD streaming events with EventDate UTC and (for stored copies) a BigObject archive with CreatedDate. BigObject retention 1 d standard, up to 6 months with add-on. |
Operations & events to hunt
- Bulk exports -
ReportExport,DataExport(weekly/monthly schedule),BulkApi/BulkApi2(large volume). Check volume and recipient. - Data Loader as a Connected App - attacker consents to Data Loader via OAuth user flow and pulls objects with the user's privileges. Review
applicationfield in Login History andSOURCE_IP. - Connected Apps / Named Credentials - new app with API scope + Refresh Token lifetime = persistence.
- Permission Set Group changes granting
ModifyAllData,ViewAllData,ExportReports,ManageConnectedApps. - Profile edits - "API Enabled," "Password Never Expires," IP range widening.
- Session Settings changes - lowered security level, extended session timeout, "Lock sessions to IP" disabled.
- Experience Cloud (Communities) - guest user profile with over-permissions → object exfil (there's a history of CVEs/misconfigs here).
- SSO / Identity Provider changes - new SAML config, new JIT provisioning rules.
- Apex code changes - triggers that email data outbound, scheduled Apex jobs doing exports.
- LoginAs admin impersonation - rare, powerful.
Response specifics
- Expire sessions:
UserManagement.expireAllPasswordsvia Apex, or Setup → Security → "Expire All Passwords." Revoke OAuth tokens per user (OauthTokenobject). - Immediately export EventLogFile for incident window - retention is short.
- Snapshot Metadata via Metadata API or
sfdx force:source:retrievefor a baseline of config. - Preserve weekly export files (admins get a ZIP) if available.
- Issue a Salesforce support case early - they can pull server-side logs beyond customer visibility.
Salesforce IR tooling: sfdx / Salesforce CLI (
sf data query for SOQL on EventLogFile, LoginHistory, SetupAuditTrail), Workbench (SOQL/REST explorer), Salesforce Event Log File Browser, SF Event Monitoring Analytics app (if Shield), Grimoire (Datadog, Salesforce playbooks), FalconPy + custom pulls, Splunk Salesforce Add-on, Metadata API via sf project retrieve start for config snapshots, Elements.cloud / Clayton for metadata diffs.2024-25 campaign note
- ShinyHunters / UNC6040 campaign (2024, surfaced broadly 2025) - vishing employees of CRM admins at Fortune 500s, directing to connect Data Loader, bulk exfil, extortion.
- Public victims disclosed: Allianz Life, several Google-adjacent orgs, Pure Storage, LVMH, Qantas (reporting varies).