Icarus Threat Group: Klue Supply Chain Attack & OAuth Token Theft — Detection Engineering

---
title: Suspicious OAuth Token Usage from Klue Integration
id: c8a1e2f3-4567-8901-2345-6789abcdef01
status: experimental
description: Detects unusual OAuth token usage patterns from Klue integration potentially indicating supply chain attack
author: Security Arsenal
date: 2026/07/22
modified: 2026/07/22
references:
    - https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/
tags:
    - attack.credential-access
    - attack.initial-access
    - attack.persistence
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AppDisplayName|contains: 'Klue'
    filter:
        AuthenticationRequirement: 'singleFactorAuthentication'
    condition: selection and not filter
falsepositives:
    - Legitimate Klue integration usage
level: high

---
title: Excessive API Calls to CRM via Integration
id: d9b2f3e4-5678-9012-3456-7890bcdef12
status: experimental
description: Detects unusually high volume of API calls to Salesforce or Gong from third-party integrations
author: Security Arsenal
date: 2026/07/22
modified: 2026/07/22
references:
    - https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/
tags:
    - attack.exfiltration
    - attack.collection
logsource:
    product: salesforce
    service: audit
detection:
    selection:
        EventName|contains: 'ApiCall'
        Application|contains: 'Klue'
    timeframe: 1h
    condition: selection | count() > 100
falsepositives:
    - Bulk data sync operations
level: high

---
title: OAuth Token Harvesting via Abandoned Integration
id: e0c3g4h5-6789-0123-4567-8901cdef23
status: experimental
description: Detects OAuth token access from dormant or abandoned integration components
author: Security Arsenal
date: 2026/07/22
modified: 2026/07/22
references:
    - https://securitylabs.datadoghq.com/articles/detecting-the-klue-supply-chain-attack-in-salesforce/
tags:
    - attack.credential-access
    - attack.valid-accounts
logsource:
    product: cloud
    service: audit
detection:
    selection:
        event.action: 'OAuthTokenRefresh'
        source.domain|contains: 'klue'
    timeframe: 24h
    condition: selection | count() > 50
falsepositives:
    - Normal token refresh cycles
level: medium

// Hunt for unusual OAuth activity from Klue integration
DeviceNetworkEvents
| where RemoteUrl has "salesforce.com" or RemoteUrl has "gong.io"
| where InitiatingProcessCommandLine has "python" or InitiatingProcessFileName has "python"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, InitiatingProcessCommandLine
| order by Timestamp desc
| summarize count() by DeviceName, RemoteUrl, bin(Timestamp, 1h)
| where count_ > 50

// Hunt for unusual API call patterns from third-party integrations
SecurityEvent
| where EventID == 5140 or EventID == 5145
| where SubjectUserName contains "Klue" or TargetUserName contains "Klue"
| project TimeGenerated, Computer, SubjectUserName, TargetUserName, AccessMask
| order by TimeGenerated desc

# OAuth Token Hunt for Klue Integration
# Scans for suspicious OAuth activity and API access patterns

function Get-KlueOAuthActivity {
    <#
    .SYNOPSIS
    Hunt for suspicious OAuth activity related to Klue integration
    
    .DESCRIPTION
    This script checks for unusual OAuth token usage and API access patterns
    that may indicate the Icarus supply chain attack on Klue
    
    .OUTPUTS
    Custom object with findings
    #>
    
    $findings = @()
    
    # Check for recent Python processes (potential automation)
    $pythonProcesses = Get-Process -Name python* -ErrorAction SilentlyContinue | 
                       Where-Object { $_.StartTime -gt (Get-Date).AddHours(-24) }
    
    if ($pythonProcesses) {
        $findings += [PSCustomObject]@{
            Category = "Python Process"
            Detail   = "Recent Python processes detected - potential automation"
            Severity = "Medium"
            Process  = $pythonProcesses.Name -join ", "
        }
    }
    
    # Check network connections to Salesforce or Gong
    $networkConnections = Get-NetTCPConnection -ErrorAction SilentlyContinue | 
                          Where-Object { $_.State -eq "Established" }
    
    foreach ($conn in $networkConnections) {
        try {
            $remoteHost = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
            if ($remoteHost -match "salesforce|gong") {
                $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
                $findings += [PSCustomObject]@{
                    Category = "Suspicious Network Connection"
                    Detail   = "Connection to CRM platform detected"
                    Severity = "High"
                    Target   = $remoteHost
                    Process  = $process.ProcessName
                    PID      = $conn.OwningProcess
                }
            }
        } catch {
            # Continue if hostname resolution fails
        }
    }
    
    # Check for OAuth token files in suspicious locations
    $oauthPaths = @(
        "$env:APPDATA\Klue",
        "$env:LOCALAPPDATA\Klue",
        "$env:TEMP\Klue*",
        "C:\ProgramData\Klue"
    )
    
    foreach ($path in $oauthPaths) {
        if (Test-Path $path) {
            $files = Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue
            foreach ($file in $files) {
                if ($file.Extension -in @'.', '.token', '.cache') {
                    $findings += [PSCustomObject]@{
                        Category = "OAuth Token File"
                        Detail   = "Potential OAuth token file found"
                        Severity = "High"
                        Path     = $file.FullName
                        Modified = $file.LastWriteTime
                    }
                }
            }
        }
    }
    
    return $findings
}

# Execute the hunt
$results = Get-KlueOAuthActivity

# Display results
if ($results) {
    Write-Host "=== KLUE OAUTH ACTIVITY HUNT RESULTS ===" -ForegroundColor Yellow
    $results | Format-Table Category, Severity, Detail, Target, Process, Path, Modified -AutoSize
} else {
    Write-Host "No suspicious Klue OAuth activity detected." -ForegroundColor Green
}