---
title: Suspicious Salesforce API Access via Klue Integration
id: 4f8a92b1-c1e3-4b5f-9a2d-3c6e7f8a9b0c
description: Detects potential OAuth abuse involving the Klue integration accessing Salesforce data, indicating a supply chain attack or compromised credentials.
status: experimental
date: 2026/07/22
author: Security Arsenal
references:
    - https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/
tags:
    - attack.credential_access
    - attack.t1528
    - attack.exfiltration
    - attack.t1041
logsource:
    product: salesforce
definition:
    condition: selection
    field_mappings:
        Application: EventType
        User: Username
detection:
    selection:
        Application|startswith: 'Klue'
        EventType|contains:
            - 'Api'
            - 'Export'
        Status: 'Success'
    timeframe: 1h
    condition: selection | count() > 100
falsepositives:
    - Legitimate bulk export operations by authorized users during reporting cycles.
level: high
---
title: Python Script User-Agent in Cloud CRM Logs
description: Identifies API requests to cloud CRM platforms (Salesforce/Gong) originating from Python User-Agents, suggesting automated exfiltration scripts.
id: d2e1f3a4-5b6c-7d8e-9f0a-1b2c3d4e5f6a
status: experimental
date: 2026/07/22
author: Security Arsenal
references:
    - https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/
tags:
    - attack.execution
    - attack.t1059.006
    - attack.exfiltration
logsource:
    category: proxy
definition:
    condition: selection
detection:
    selection:
        c-uri-path|contains:
            - 'services/data'
            - 'api/v1'
        c-user-agent|contains: 'python'
        sc-status: 200
    filter:
        c-user-agent|contains: 'sfdc-camel'
    condition: selection and not filter
falsepositives:
    - Legitimate Python-based integration tools used by development teams.
level: medium
---
title: High Volume Data Exfiltration via API
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects a high volume of data retrieval from CRM APIs within a short timeframe, indicative of bulk data theft.
status: experimental
date: 2026/07/22
author: Security Arsenal
references:
    - https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/
tags:
    - attack.exfiltration
    - attack.t1041
logsource:
    product: azure
definition:
    condition: selection
detection:
    selection:
        OperationName|contains:
            - 'Read'
            - 'Get'
            - 'Export'
        Category|contains: 'DataManagement'
    timeframe: 10m
    condition: selection | count() > 500
falsepositives:
    - Authorized bulk data exports for reporting or migration.
level: high


kql
// Hunt for anomalous Salesforce access patterns associated with Klue integration
// DeviceNetworkEvents or IdentityLogonEvents based on data connector availability
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl contains "salesforce.com" or RemoteUrl contains "gong.io"
| where InitiatingProcessFileName =~ "python.exe" or InitiatingProcessCommandLine contains "python"
| summarize Count = count() by DeviceName, InitiatingProcessAccount, RemoteUrl
| where Count > 50
| project DeviceName, InitiatingProcessAccount, RemoteUrl, Count
| order by Count desc

// Hunt for OAuth token abuse signs in Cloud App logs (if available via Syslog/CEF)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine contains "oauth" and ProcessCommandLine contains "token"
| where ProcessCommandLine contains "klue"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath


powershell
# PowerShell script to audit local systems for unauthorized OAuth tools or scripts
# Specifically checks for Python scripts interacting with known API endpoints

Write-Host "Scanning for potential Icarus/Klue related scripts..." -ForegroundColor Cyan

# Check for Python scripts created/modified recently in common user directories
$paths = @("$env:USERPROFILE\Documents", "$env:USERPROFILE\Downloads", "C:\Temp")
$extensions = @("*.py")
$keywords = @("salesforce", "gong", "oauth", "api", "token")

$recentFiles = Get-ChildItem -Path $paths -Include $extensions -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }

$threatFiles = @()
foreach ($file in $recentFiles) {
    $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
    foreach ($keyword in $keywords) {
        if ($content -like "*$keyword*") {
            $threatFiles += $file.FullName
            break
        }
    }
}

if ($threatFiles.Count -gt 0) {
    Write-Host "[ALERT] Found suspicious Python scripts containing CRM/OAuth keywords:" -ForegroundColor Red
    $threatFiles | ForEach-Object { Write-Host " - $_" -ForegroundColor Yellow }
} else {
    Write-Host "No suspicious Python scripts found in standard user directories." -ForegroundColor Green
}

# Check for established network connections to Salesforce or Gong (requires Admin privs)
try {
    $connections = Get-NetTCPConnection -State Established -ErrorAction Stop | 
        Where-Object { $_.RemoteAddress -ne "127.0.0.1" -and $_.RemoteAddress -ne "::1" }
    
    $remoteHosts = $connections | ForEach-Object {
        try { 
            [System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName 
        } catch { 
            $_.RemoteAddress 
        }
    }
    
    $suspiciousConnections = $remoteHosts | Where-Object { $_ -match "salesforce" -or $_ -match "gong" }
    
    if ($suspiciousConnections) {
        Write-Host "[ALERT] Active connections to Salesforce or Gong detected:" -ForegroundColor Red
        $suspiciousConnections | ForEach-Object { Write-Host " - $_" -ForegroundColor Yellow }
    }
} catch {
    Write-Host "Could not enumerate network connections. Run as Administrator." -ForegroundColor Gray
}


# Response Priorities

*   **Immediate:** Revoke all OAuth tokens associated with the Klue integration within Salesforce and Gong environments. Block IP ranges identified in any exfiltration logs (if available).
*   **24 Hours:** Conduct a comprehensive audit of Klue integration permissions. Verify all recent data exports and login sessions for Salesforce and Gong accounts. Rotate API keys for any connected systems.
*   **1 Week:** Implement stricter governance for third-party OAuth applications. Mandate review and deprovisioning of dormant or prototype integrations. Enhance monitoring for SaaS API usage anomalies (UEBA/UEBA for SaaS).