Your CRM holds a map of your customers. MITRE ATT&CK tracks the abuse of that map as T1213.004, Customer Relationship Management Software, a sub-technique of Data from Information Repositories. It sits in the Collection tactic and applies to SaaS platforms.
MITRE lists Microsoft Dynamics 365, Salesforce, Zoho, Zendesk and HubSpot as examples. The software can be hosted on premises or in the cloud, and what it stores varies by instance.
How attackers use it
Once an adversary has access to the victim organization, they can mine the CRM. MITRE says this may include full names, emails, phone numbers and addresses, plus purchase histories and IT support interactions.
The reason it matters is what happens next. According to MITRE, that data can feed personalized phishing emails, SIM swapping, or other attacks on the organization's customers that lead to financial gain or the compromise of more organizations. A CRM breach is often the first step in a breach somewhere else.
How to detect it
The detection strategy on the MITRE page is built around behavior, not signatures. The signal is anomalous, high-volume access to customer records by an account that is not a CRM admin. It gets more suspicious when the account first authenticated from a rare location or device, or when the activity includes abnormal reads of PII fields or data exports in a short window.
In practice, that means you want the CRM's own audit and login logs flowing somewhere you can query. Build a baseline of how many records a normal sales or support user touches per day, and alert on the outliers.
How to reduce the risk
MITRE lists four mitigations:
- Enforce least privilege, with both authentication and authorization controls, so a stolen account sees only what its owner needs.
- Publish policies on what may be stored in the CRM and how customer data is handled. Store only what the business needs.
- Set data retention policies that archive or delete data you no longer need.
- Review accounts and privileges for critical and sensitive CRM data on a regular schedule.
Quick check
Which account behavior does the MITRE detection strategy focus on?
High-volume access to customer records by a non-admin account, especially after a first sign-in from a rare location or device, or with PII access or exports in a short time window.
Why does deleting old CRM data help?
Data you no longer keep cannot be mined. Retention policies shrink what an intruder can collect.
Sources
- MITRE ATT&CK, T1213.004: https://attack.mitre.org/techniques/T1213/004
