Classification:

attack

Tactic:

TA0006-credential-access

Technique:

T1110-brute-force

VIEW RULE IN DATADOG VIEW SIGNALS

Goal

Detect when a disabled or frozen user account attempts to log in to Salesforce.

Strategy

This rule monitors Salesforce login events through both Event Log File (ELF) and Real Time Event Monitoring (RTEM) logging tiers.

For @evt.name:Login events, this rule monitors @login_status for LOGIN_ERROR_USER_INACTIVE or LOGIN_ERROR_USER_FROZEN values.

For @evt.name:LoginEvent events, this rule monitors @status for User is Inactive or User is Frozen values.

If three or more authentication attempts occur for the same disabled or frozen user account, a signal is created. Login attempts categorized as corporate VPN traffic are excluded.

Triage & Response

• Examine the IP address, ASN, and geographic location associated with the login attempts for the user account.
• Review the user account for any successful login attempts.
• Verify if the IP address has attempted to log in to other user accounts within your Salesforce environment.
• If the IP address or user account demonstrates evidence of suspicious activities, initiate your incident response plan.

Changelog

• 12 September 2026 - The rule now monitors disabled or frozen account login attempts in both ELF and RTEM logging tiers. The threshold is three or more attempts.