Most Important ShinyHunters Detection 2026: Anomalous Volume Salesforce Bulk API/SOQL Query Activity
Detects anomalous, high-volume data access patterns within Salesforce, specifically monitoring for bulk API or SOQL query requests by a single user or application. This behavior is indicative of mass data exfiltration from a CRM instance, a tactic observed in extortion-themed campaigns such as those associated with the ShinyHunters group.
YARA-L
