{"id":"T1213.004","name":"Customer Relationship Management Software","url":"https://attack.mitre.org/techniques/T1213/004","tactics":["collection"],"platforms":["SaaS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0550","stix_id":"x-mitre-detection-strategy--34fb7d2b-f5be-45a2-9cdc-811ae843e379","name":"Detecting Suspicious Access to CRM Data in SaaS Environments","url":"https://attack.mitre.org/detectionstrategies/DET0550","analytics":[{"id":"AN1520","stix_id":"x-mitre-analytic--616bc2d5-5c4d-4efa-9490-c77213be1de1","name":"Analytic 1520","description":"Anomalous high-volume access to customer records in CRM software by a non-CRM admin user account, especially following initial authentication from a rare location or device. Behavior includes abnormal access to PII fields or data exports within a short time window.","url":"https://attack.mitre.org/detectionstrategies/DET0550#AN1520","platforms":["SaaS"],"log_source_references":[{"name":"saas:salesforce","channel":"DataExport, RestAPI, Login, ReportExport","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-salesforce"},{"name":"m365:signinlogs","channel":"UserLoggedIn","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"m365-signinlogs"}],"mutable_elements":[{"field":"TimeWindow","description":"Duration over which bulk CRM queries occur (e.g., 1 minute, 5 minutes); varies by organization usage pattern"},{"field":"UserContext","description":"User's CRM role, department, or job function (e.g., non-sales user accessing customer PII)"},{"field":"AnomalousExportThreshold","description":"Number of CRM objects (contacts, deals, logs) accessed or exported above normal"},{"field":"SourceLocation","description":"Rare or impossible geolocation/IP address for legitimate CRM user access"}],"live":true,"detection_strategies":["DET0550"],"techniques":["T1213.004"]}],"live":true,"version":"1.0","techniques":["T1213.004"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}