Salesforce SOQL Query for Sensitive Credentials

Tim Peck@timpeck

•updated Aug 27, 2025•5•1•152

Detects Salesforce Object Query Language (SOQL) queries that may be attempting to access or exfiltrate sensitive credentials like passwords, API keys, or tokens stored within Salesforce objects. This activity was observed in the UNC6395 campaign where attackers targeted AWS keys, Snowflake tokens, and passwords.