Most Significant ShinyHunters 2026: Anomalous High-Rate POST Requests to Salesforce Aura Endpoint Consistent with AuraInspector-Style Probing
Detects an abnormally high volume of POST requests from a single source to the Salesforce Aura API endpoint (/s/sfsites/aura) within a short window, which is indicative of automated guest profile enumeration and AuraInspector-style probing activity associated with the ShinyHunters Salesforce campaigns.
Microsoft Sentinel (KQL)
