---
title: Credential stuffing attack on Salesforce
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Credential stuffing attack on
  Salesforce
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Credential stuffing attack on Salesforce
Classification:attackTactic:[TA0006-credential-access](https://attack.mitre.org/tactics/TA0006)Technique:[T1110-brute-force](https://attack.mitre.org/techniques/T1110) 
## Goal{% #goal %}

Detect an account take over (ATO) through credential stuffing attack against a Salesforce account.

A credential stuffing attack is used to gain initial access by compromising user accounts. In this type of attack, a list of compromised usernames and passwords from a previous user database breach, phishing attempt, or other means is obtained. Then, the attacker uses the list of usernames and passwords to attempt to log in to user accounts.

## Strategy{% #strategy %}

This rule monitors Salesforce login events through both Event Log File (ELF) and Real Time Event Monitoring (RTEM) logging tiers.

For `@evt.name:Login` events, this rule monitors `@login_status` for `LOGIN_NO_ERROR`, indicating a successful login, or `LOGIN_ERROR_INVALID_PASSWORD`, indicating a failed attempt to log in using an invalid password.

For `@evt.name:LoginEvent` events, this rule monitors `@status` for `Success`, indicating a successful login, or `Invalid Password`, indicating a failed attempt to log in using an invalid password.

**To determine a successful attempt:** Detect a high number of failed logins from five or more unique users and at least one successful login for a user from the same IP address.

**To determine an unsuccessful attempt:** Detect a high number of failed logins from five or more unique users from the same IP address.

The detection logic monitors for a spike in activity from a single IP address across multiple users. However, an attacker may also use multiple IP addresses to target your application in order to distribute the attack load and make it more difficult to detect.

## Triage and response{% #triage-and-response %}

- Examine the IP address, ASN, and geographic location associated with the login attempts for the user accounts.
- Review affected user accounts for any successful login attempts.
- Verify if the IP address has attempted to login to other user accounts or take further actions within your Salesforce environment.
- If the IP address or user accounts demonstrate evidence of suspicious activities, initiate your incident response plan.

## Changelog{% #changelog %}

- 5 January 2023 - Updated query, severity of cases, and group by values.
- 14 August 2026 - Added support for both Salesforce Real-Time Event Monitoring (`LoginEvent` / `@status`) and Event Log File (`Login` / `@login_status`) log formats by splitting failed and successful login queries into RTEM and ELF variants. Updated case conditions to fire when thresholds are met in either format. Removed `@login_url` from group-by, narrowed RTEM failed-login filter to `Invalid Password` only.