Salesforce Aura Endpoint POST With Aura
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google AuraInspector Salesforce Aura Audit. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: an HTTP POST to a Salesforce /aura endpoint that includes specific Aura method strings. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/auditing-salesforce-aura-data-exposure) to document where the indicator came from and to support incident notes and reporting.
Sigma
