DriftToken — Salesloft Drift → Salesforce OAuth Data Theft (UNC6395)

Looks for: API/SOQL events attributed to the Drift Connected App returning large row counts over key objects. Accomplishes: the core mass-export signal. FP: legitimate Drift sync — baseline its normal volume.

// HUNT: Drift Connected App bulk SOQL export (UNC6395)
// MITRE: T1213, T1550.001 | CONF: high  FP: low-med  COST: med
// NOTE: field tokens depend on your Salesforce->NG-SIEM parser — validate
connectedAppName=/drift/i
| Query=/SELECT.+FROM\s+(Account|Contact|Case|Opportunity|Lead|User)/i
| groupBy([connectedAppName, sessionKey, sourceIp], function=[count(as=calls), sum(field=rowsProcessed, as=rows)])
| rows>=1000
| table([connectedAppName, sessionKey, sourceIp, calls, rows], limit=200)

Looks for: Drift Connected-App API activity from Tor exit nodes / hosting-provider (VPS) ASNs or new geographies. Accomplishes: attacker-infra detection. FP: none if you maintain the Drift egress allow-list.

// HUNT: Drift token API access from anomalous source IP (Tor/VPS)
// MITRE: T1550.001 | CONF: high  FP: low-med  COST: low
// TUNING: maintain Drift's known egress CIDRs; enrich sourceIp with Tor/hosting-ASN feeds
connectedAppName=/drift/i
| sourceIp!=/^(REPLACE_WITH_DRIFT_EGRESS_CIDRS)/
| (asnType=/hosting|vps|tor/i or isTorExitNode=true)
| table([connectedAppName, userPrincipalName, sourceIp, autonomousSystemNumber, @timestamp], limit=200)

Looks for: Drift API activity whose User-Agent differs from Drift's normal client string (e.g., generic Python/requests/curl). FP: Drift UA changes on updates — baseline first.

// HUNT: anomalous User-Agent on Drift Connected App API
// MITRE: T1550.001 | CONF: medium  FP: medium  COST: low
// TUNING: baseline Drift's legitimate User-Agent(s); flag python/requests/curl/Go-http-client
connectedAppName=/drift/i
| userAgent=/(python-requests|curl|Go-http-client|okhttp|^$|libwww|axios)/i
| table([connectedAppName, userAgent, sourceIp, @timestamp], limit=200)

Looks for: any Connected App / session exporting record volumes well above baseline. Accomplishes: catches mass theft even by a different abused integration. FP: legitimate bulk jobs — baseline per app.

// HUNT: Salesforce mass-record export spike (any integration)
// MITRE: T1213 | CONF: med-high  FP: medium  COST: med
// TUNING: set the threshold from your per-app baseline; include ReportExport + BulkApi events
eventType=/ApiEvent|BulkApiResultEvent|ReportExportEvent/i
| groupBy([connectedAppName, userPrincipalName, sessionKey], function=[sum(field=rowsProcessed, as=rows)])
| rows>=5000
| sort(rows, order=desc)

Looks for: queries touching objects/fields known to hold secrets (notes, case bodies, custom cred fields). Accomplishes: prioritizes which secrets to rotate first. FP: depends on knowing where secrets live in your org.

// HUNT: access to Salesforce fields/objects known to hold secrets
// MITRE: T1552.001 | CONF: medium  FP: medium  COST: low
// TUNING: populate your org's secret-bearing objects/fields (notes, case bodies, custom cred fields)
eventType=/ApiEvent|BulkApiResultEvent/i
| Query=/(AKIA|ASIA|snowflakecomputing|VpnSecret|password|secret|apikey|token)/i
| table([connectedAppName, userPrincipalName, sourceIp, Query, @timestamp], limit=200)

Looks for: AWS/Snowflake API use (in your cloud logs) from new IPs/ASNs for keys that were stored in Salesforce. Accomplishes: catches the lateral pivot. FP: requires cloud-audit ingestion + the list of exposed keys.

// HUNT: leaked-credential use downstream (AWS/Snowflake) from new infra
// MITRE: T1550.001, T1078.004 | CONF: medium  FP: medium  COST: med
// REQUIRES: AWS CloudTrail / Snowflake logs ingested; populate the exposed-key list
// TUNING: populate BOTH REPLACE_WITH lists before running -- left unpopulated the accessKeyId regex matches nothing and a clean result proves nothing. Known-good CIDRs must cover CI/CD egress and SaaS integration ranges, or every legitimate automated call fires.
eventSource=/cloudtrail|snowflake/i
| accessKeyId=/REPLACE_WITH_EXPOSED_KEY_IDS/i
| sourceIPAddress!=/^(REPLACE_WITH_KNOWN_GOOD_CIDRS)/
| table([eventSource, accessKeyId, sourceIPAddress, eventName, @timestamp], limit=200)