T1213.004 — Customer Relationship Management Software

Tactic: Collection · Platforms: SaaS

Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine…

Sub-technique of Data from Information Repositories (T1213).

Sigma detection rules (1)

T1213.004 Data from Information Repositories: Customer Relationship Management Software

title: "T1213.004 Data from Information Repositories: Customer Relationship Management Software"
id: e1227ba1-7c6f-4716-baac-dc3fbc325f7a
description: 'Detecting Suspicious Access to CRM Data in SaaS Environments. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: TimeWindow, UserContext, AnomalousExportThreshold, SourceLocation.'
references:
  - https://attack.mitre.org/techniques/T1213/004
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.collection
  - attack.t1213.004

logsource:
  product: saas
  service: salesforce

detection:
  selection_report_export:
    EventType:
      - 'Report'
      - 'BulkApiRequestEvent'
    Status: 'Success'
  selection_listview:
    EventType: 'ListViewEvent'

  condition: selection_report_export or selection_listview

falsepositives:
  - Sales operations staff running scheduled CRM reports or bulk data syncs to a connected marketing tool; a genuine export-volume-anomaly baseline is required to isolate bulk exfiltration.

level: medium

Related sub-techniques

Explore