Anomalous Salesforce Bulk API Activity (Shinyhunters)
Details: Baseline detection to identify rare usage of Salesforce bulk API operations initiated by a user/service account not previously seen performing similar actions within the last 7 days. This includes the specific attack chain where a victim is socially engineered into granting consent to a malicious OAuth application which is subsequently used to perform bulk API operations. Hypothesis: An adversary associated with Shinyhunters may use a compromised Salesforce identity to perform first-time bulk API activity in order to enumerate and collect large volumes of CRM records for data theft and extortion. Actions: Review detection details to identify: affected Salesforce instance, the initiating user/service account and any associated connected apps. Pivot on these details to identify wider activity and, if necessary, reach out to the appropriate application owner to confirm directly. References: https://cybersecuritynews.com/shinyhunters-6-million-customers-records-odido/ https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/ https://developer.salesforce.com/docs/platform/api-asynch/guide/asynch-api-intro.html
Microsoft Sentinel (KQL)
