Salesforce Unc6395 Data Exfiltration Queries

Jonathan Paykoc@cybershenanigans

•updated Sep 26, 2025•1•2•212

Detects a series of Salesforce Object Query Language (SOQL) queries indicative of data reconnaissance and exfiltration, similar to techniques used by UNC6395.