tfMITRE ATT&CK sub-technique

Customer Relationship Management Software T1213.004

sub-technique of T1213 Data from Information Repositories

Tactic: Collection
Platform: SaaS
Version: 1.0
Created: 01 July 2024
Last modified: 15 April 2025
Contributor: Centre for Cybersecurity Belgium (CCB)

Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Customer Relationship Management Software MITRE reference T1213.004

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Salesforce Data ExfiltrationC0059 ↗

During Salesforce Data Exfiltration, threat actors accessed and exfiltrated sensitive information from compromised Salesforce instances.1

2004–2025

All 1 campaigns for this technique

Offense vs defense T1213.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Customer Relationship Management Software detection strategy DET0550

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting Suspicious Access to CRM Data in SaaS Environments

Enterprise

1 platform

AN1520 · SaaS

Anomalous high-volume access to customer records in CRM software by a non-CRM admin user account, especially following initial authentication from a rare location or device. Behavior includes abnormal access to PII fields or data exports within a short time window.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Application Log ContentDC0038	saas:salesforce	DataExport, RestAPI, Login, ReportExport
Logon Session CreationDC0067	m365:signinlogs	UserLoggedIn

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Duration over which bulk CRM queries occur (e.g., 1 minute, 5 minutes); varies by organization usage pattern
UserContext	User's CRM role, department, or job function (e.g., non-sales user accessing customer PII)
AnomalousExportThreshold	Number of CRM objects (contacts, deals, logs) accessed or exported above normal
SourceLocation	Rare or impossible geolocation/IP address for legitimate CRM user access

Customer Relationship Management Software detections T1213.004

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs