Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1078-valid-accounts

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when Salesforce activity occurs from suspicious IP addresses.

Strategy

Using logs generated by Salesforce audit logging, IP addresses are monitored in relation to:

• Tor exit nodes
• Non-corporate VPNs
• Hosting or botnet proxy networks
• Suspicious or malicious threat intelligence

Not all Salesforce event logs include an IP address. This detection triggers on any action that occurs with an IP address included in the log.

Triage and response

• Examine the associated user ID and event that occurred within the Salesforce audit logs.
• Determine if the event succeeded and if the {{@network.client.ip}} is expected within your environment.
• If the activity is unauthorized or suspicious, initiate your incident response plan.