Most Popular ShinyHunters 2026 Detection: Anomalous Salesforce Bulk API or SOQL
Detects high-volume data exports or bulk API queries against sensitive Salesforce CRM objects (Accounts, Contacts, Cases, Opportunities) performed by connected applications. This pattern is characteristic of exfiltration efforts where a newly authorized OAuth application is used to quickly extract large quantities of sensitive records.
Sigma
