Most Critical ShinyHunters 2026: Mass SOQL Query Enumeration of Salesforce Case, Account and Contact Objects
Detects a single Salesforce user or connected-app session performing an anomalous volume of SOQL queries against sensitive objects including Case, Account, Contact, and Opportunity. This behavior is indicative of mass data enumeration and potential exfiltration, as observed in historical incidents where attackers targeted CRM platforms to extract embedded secrets and sensitive record data.
Microsoft Sentinel (KQL)
