Supply Chain Attack: Detecting Klue OAuth Token Abuse and Salesforce Compromise

---
title: Potential OAuth Token Abuse - Klue Connected App Anomalous Access
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects access to Salesforce via the Klue Connected App from an IP address not previously associated with the application or user, indicating potential token theft.
references:
  - https://attack.mitre.org/techniques/T1528/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1528
logsource:
  product: azure
  service: signins
detection:
  selection:
    AppDisplayName|contains: 'Klue'
    Status: 'Success'
  filter_legit_location:
    IPAddress|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '172.16.0.0/12'
  condition: selection and not filter_legit_location
falsepositives:
  - Legitimate remote usage by Klue support or admins from new locations
level: high
---
title: High Volume Data Export via SaaS Integration
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects sudden high volume of record queries or exports from a third-party SaaS integration (like Klue) within Salesforce.
references:
  - https://attack.mitre.org/techniques/T1530/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1530
logsource:
  product: cloud
  service: salesforce
detection:
  selection:
    EventName|contains:
      - 'Export'
      - 'Query'
      - 'ApiAnonymousIntegration'
    Application|contains: 'Klue'
  timeframe: 10m
  condition: selection | count() > 50
falsepositives:
  - Scheduled reporting or bulk data sync operations
level: medium


━━━ KQL (MICROSOFT SENTINEL) ━━━

// Hunt for successful sign-ins by the Klue application from unusual IPs or UserAgents
SigninLogs
| where AppDisplayName contains "Klue"
| where ResultType == 0
| extend IsNewIP = iff(IPAddress in (SigninLogs
    | where AppDisplayName contains "Klue"
    | where TimeGenerated between(now(-30d)..now())
    | distinct IPAddress), false, true)
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, DeviceDetail, IsNewIP
| where IsNewIP == true
| order by TimeGenerated desc

// Correlate with potential data exfiltration in Salesforce (via Syslog/CEF)
Syslog
| where Facility == "Salesforce"
| where Message contains "Klue" and (Message contains "Export" or Message contains "download")
| parse Message with * "User: " User " " * "Action: " Action " " *
| summarize count() by User, Action, bin(TimeGenerated, 5m)
| where count_ > 20


━━━ VELOCIRAPTOR VQL ━━━

// Hunt for local CLI tools or browser artifacts that might be interacting
// with Salesforce or Klue APIs, indicating a local compromise or admin activity.
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'sf.exe' 
   OR Name =~ 'sfdx.exe'
   OR CommandLine =~ 'salesforce'
   OR CommandLine =~ 'klue'

// Check for suspicious browser extensions related to Klue/Salesforce
SELECT FullPath, Name, Version
FROM glob(globs='/*/Extensions/*/*/manifest.')
WHERE read_file(filename=FullPath) =~ 'klue'


━━━ REMEDIATION SCRIPT (POWERSHELL) ━━━

# Requires Microsoft Graph PowerShell SDK
# Connect-MgGraph -Scopes "Application.Read.All", "AppRoleAssignment.ReadWrite.All", "Directory.ReadWrite.All"

Write-Host "[+] Auditing OAuth Grants for Klue/Salesforce Integrations..." -ForegroundColor Cyan

# Get Service Principals that might be related to the threat
$Apps = Get-MgServicePrincipal -Filter "DisplayName eq 'Klue' or DisplayName eq 'Salesforce'"

foreach ($App in $Apps) {
    Write-Host "[!] Checking grants for: $($App.DisplayName)" -ForegroundColor Yellow
    
    # Retrieve OAuth2PermissionGrants (Delegated permissions)
    $Grants = Get-MgOauth2PermissionGrant -Filter "ClientId eq '$($App.Id)'"
    
    if ($Grants) {
        Write-Host "    Found $($Grants.Count) active OAuth grants." -ForegroundColor Red
        foreach ($Grant in $Grants) {
            $ConsentType = $Grant.ConsentType
            $PrincipalId = $Grant.PrincipalId
            Write-Host "    - Grant Type: $ConsentType | Scope: $($Grant.Scope)"
            
            # WARNING: Uncomment the line below to REVOKe the grant immediately
            # Remove-MgOauth2PermissionGrant -OAuth2PermissionGrantId $Grant.Id
        }
    } else {
        Write-Host "    No active delegated grants found." -ForegroundColor Green
    }

    # Retrieve AppRoleAssignments (Application permissions)
    $AppRoles = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $App.Id
    if ($AppRoles) {
        Write-Host "    Found $($AppRoles.Count) Application Role Assignments." -ForegroundColor Red
    }
}

Write-Host "[+] Audit complete. Review results. If compromise is confirmed, rotate Client Secrets and revoke Sessions in Salesforce Setup." -ForegroundColor Cyan