t1199-trusted-relationship

name	T1199_trusted-relationship
description	Adversaries may breach or otherwise leverage organizations who have access to intended victims.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1199","initial-access","windows","saas","iaas","linux","macos","identity-provider","office-suite"]
technique_id	T1199
tactic	initial-access
all_tactics	["initial-access"]
platforms	["Windows","SaaS","IaaS","Linux","macOS","Identity Provider","Office Suite"]
mitre_url	https://attack.mitre.org/techniques/T1199
tech_stack	["windows","saas","cloud","linux","macos","identity","office"]
cwe_ids	["CWE-20"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1199 Trusted Relationship

High-Level Description

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.

In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.

Kill Chain Phase

• Initial Access (TA0001)

Platforms: Windows, SaaS, IaaS, Linux, macOS, Identity Provider, Office Suite

What to Check

• Identify if Trusted Relationship technique is applicable to target environment
• Check Windows systems for indicators of Trusted Relationship
• Check SaaS systems for indicators of Trusted Relationship
• Check IaaS systems for indicators of Trusted Relationship
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Trusted Relationship by examining the target platforms (Windows, SaaS, IaaS).

2. Assess Existing Defenses: Review whether mitigations for T1199 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.