UNC6395 Malicious User Agent Strings

Tim Peck@timpeck

•updated Aug 26, 2025•6•2•108

Detects the use of known malicious or suspicious User-Agent strings associated with the UNC6395 data theft campaign targeting Salesforce instances.