Klue-Salesforce Supply Chain Attack: Detecting and Containing Third-Party OAuth Abuse

---
title: Potential Salesforce Third-Party OAuth Token Abuse
id: 8a1c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects potential unauthorized access via Connected App (e.g., Klue) based on high-frequency login or unusual API usage in ingested Salesforce CEF/Syslog logs.
references:
  - https://attack.mitre.org/techniques/T1078/004/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.valid_accounts
  - attack.t1078.004
  - attack.initial_access
logsource:
  product: cef
  service: salesforce
detection:
  selection:
    deviceAction|contains: 'Login'
    request|contains: 'ConnectedApp'
    cn1|contains: 'Klue' # Or specific ConnectedApp ID if known
  condition: selection
falsepositives:
  - Legitimate bulk synchronization operations by Klue administrators
level: high
---
title: Salesforce Data Export via Connected App
id: 9b2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects mass data export or query activities initiated by a non-human Connected App user context.
references:
  - https://attack.mitre.org/techniques/T1119/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.collection
  - attack.t1119
logsource:
  product: cef
  service: salesforce
detection:
  selection:
    deviceAction|contains:
      - 'Export'
      - 'Query'
    request|contains: 'API'
    cs5|contains: 'Klue' # cs5 often maps to Application or User Type in CEF
  timeframe: 1h
  condition: selection | count() > 50
falsepositives:
  - Scheduled reporting or legitimate intelligence gathering during business hours
level: medium

// Hunt for high volume of Salesforce login events specifically from the Klue Connected App
// Assumes Salesforce logs are ingested into Sentinel via Syslog or CommonSecurityLog
Syslog
| where SyslogMessage contains "Salesforce" 
| where SyslogMessage contains "Login" 
| where SyslogMessage contains "Klue" 
| extend EventDetail = extract(@'Action=(.*?\s)', 1, SyslogMessage), 
         User = extract(@'User=(.*?\s)', 1, SyslogMessage), 
         SourceIP = extract(@'SourceIP=(.*?\s)', 1, SyslogMessage)
| summarize count() by bin(TimeGenerated, 15m), SourceIP, User
| where count_ > 10 // Threshold for suspicious activity
| project TimeGenerated, SourceIP, User, count_
| order by TimeGenerated desc

-- Hunt for unexpected network connections to Salesforce infrastructure endpoints
-- This helps identify if a compromised workstation is being used to access Salesforce API directly
SELECT 
  Fqdn, 
  RemoteAddress, 
  Pid, 
  Name, 
  UserName, 
  StartTime
FROM netstat()
WHERE Fqdn =~ "\\.salesforce\.com$" 
   OR Fqdn =~ "\\.force\.com$"
ORDER BY StartTime DESC
LIMIT 50

#!/bin/bash
# Remediation: Revoke OAuth Session for a specific Connected App (Klue)
# Note: This script requires a valid Salesforce Session ID and the Connected App Consumer Key.
# Replace CONSUMER_KEY and SESSION_ID with actual values from your environment audit.

CONSUMER_KEY="YOUR_KLUE_CONNECTED_APP_CONSUMER_KEY"
SF_INSTANCE_URL="https://yourinstance.my.salesforce.com"
SESSION_ID="YOUR_VALID_ADMIN_SESSION_ID"

echo "[*] Initiating audit of active sessions for Connected App: $CONSUMER_KEY"

# Query for active sessions associated with the connected app user context
# This requires the Tooling API or standard REST API access depending on specific setup
# Below is a representative revoke command structure for a specific session if a SessionId is known

if [ -z "$1" ]; then
  echo "[!] Usage: $0 <SessionIdToRevoke>"
  echo "[!] Obtain SessionIds from Salesforce Setup > Session Management"
  exit 1
fi

TARGET_SESSION=$1

echo "[*] Attempting to revoke session: $TARGET_SESSION"

# Revoke the session using Salesforce OAuth Revoke endpoint
curl -s "$SF_INSTANCE_URL/services/oauth2/revoke" \
  -d "token=$TARGET_SESSION" \
  -H "Authorization: Bearer $SESSION_ID" \
  -H "Content-Type: application/x-www-form-urlencoded"

echo ""
echo "[*] Remediation action sent. Verify in Salesforce Setup > Session Management."