# Mapping out your unknown: A threat hunter's guide to Salesforce

DevFeed: [Mapping out your unknown: A threat hunter's guide to Salesforce](<https://devfeed.tech/articles/mapping-out-your-unknown-a-threat-hunter-s-guide-to-salesforce-8292.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/mapping-out-your-unknown-threat-hunters-guide-to-salesforce/>)

Author: Julie Agnes Sparks

Published: 2026-06-16T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Reconnaissance](<https://devfeed.tech/topics/recon.md>), [Software as a service](<https://devfeed.tech/topics/saas.md>), [OAuth](<https://devfeed.tech/topics/oauth.md>), [Single sign-on (SSO)](<https://devfeed.tech/topics/sso.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [API](<https://devfeed.tech/topics/api.md>), [log management](<https://devfeed.tech/topics/log-management.md>), [Monitoring](<https://devfeed.tech/topics/monitoring.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [data](<https://devfeed.tech/tags/data.md>), [guide](<https://devfeed.tech/tags/guide.md>), [logging](<https://devfeed.tech/tags/logging.md>), [monitoring](<https://devfeed.tech/tags/monitoring.md>), [oauth](<https://devfeed.tech/tags/oauth.md>), [post](<https://devfeed.tech/tags/post.md>), [saas](<https://devfeed.tech/tags/saas.md>), [salesforce](<https://devfeed.tech/tags/salesforce.md>), [security](<https://devfeed.tech/tags/security.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

## AI overview

A threat-hunting guide to Salesforce that describes common attack paths, including compromised OAuth applications, stolen SSO and MFA credentials, resource discovery, data extraction, and ransomware. It provides detection queries and explains how Salesforce audit logging tiers support investigation, with queries mapped to MITRE ATT&CK tactics.

## Source excerpt

In this post, we walk through different threats to Salesforce and how to detect them.