Mapping out your unknown: A threat hunter’s guide to Salesforce

This Datadog Security Research guide describes attacker playbooks targeting Salesforce — from authentication abuse (compromised credentials or OAuth tokens) through enumeration and large-scale data collection to exfiltration — and provides ELF/RTEM detection queries mapped to MITRE ATT&CK to help hunters detect reconnaissance, credential misuse, OAuth abuse, and extraction behaviors.