Most Critical ShinyHunters 2026: Low-and-Slow Salesforce Data Exfiltration via Scheduled API Export Pattern
Detects anomalous Salesforce API export patterns where a user or connected application maintains a daily record export volume below typical burst thresholds, yet accumulates a high total volume over a rolling 7-day period. This pattern mimics 'low-and-slow' data exfiltration techniques used by actors like ShinyHunters to evade standard volume-based DLP alerts.
Microsoft Sentinel (KQL)
