UNC6395 Suspicious Salesforce SOQL Queries

Aaron Mog@AaronMogS2S

•updated Aug 26, 2025•5•1•177

Detects the execution of specific SOQL (Salesforce Object Query Language) queries associated with the UNC6395 data theft campaign. The actor used these queries to enumerate and exfiltrate data from sensitive Salesforce objects.