TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

NetSPI

Auditing Salesforce Permission Hierarchies with ForceHound

Weylon Solis · 2026-04-17 · Read original ↗

ATT&CK techniques detected

6 predictions
T1525Implant Internal Image
90%
"40 edge kinds. here ’ s what those edges represent. capability edges ( 15 system permissions ) these are the permissions that matter most for privilege escalation : modifyalldata viewalldata authorapex manageusers customizeapplication manageprofilespermissionsets assignpermission…"
T1525Implant Internal Image
77%
"s no deny mechanism. object - level security + field - level security + record - level security : three independent axes of access control. a user can have object access but not field access, or field access but not record access. role hierarchy : vertical access inheritance. a m…"
T1654Log Enumeration
65%
"##hound audit log at level 3 can be ingested directly into splunk, elastic, microsoft sentinel, or aws security lake with minimal configuration. # collect with full forensic audit logging python - m forcehound \ - - collector aura \ - - instance - url " https : / / yourorg. light…"
T1588.002Tool
42%
"##hound is open source and available at https : / / github. com / netspi / forcehound. thanks for reading. the post auditing salesforce permission hierarchies with forcehound appeared first on netspi."
T1525Implant Internal Image
41%
", candelete, canviewall, canmodifyall, and canviewallfields. these edges show which permission sets and profiles can touch which objects, derived from objectpermissions records. in a large org, this produces tens of thousands of edges. if you only care about identity paths and ca…"
T1525Implant Internal Image
32%
"auditing salesforce permission hierarchies with forcehound the problem nobody graphs salesforce organizations are designed to be dynamic, evolving as a business grows. over time, an organization naturally accumulates layers of access : a profile for a new department, permission s…"

Summary

Discover how ForceHound automates the collection of profiles, permission sets, and connected apps to reveal the true trust boundaries of your Salesforce organization.

The post Auditing Salesforce Permission Hierarchies with ForceHound  appeared first on NetSPI.