VOID MANTICOREG1055 ↗
Has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.1
tfMITRE ATT&CK technique
Trusted Relationship T1199
- Tactic
- Initial Access
- Platforms
- IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows
- Version
- 2.4
- Created
- 18 April 2018
- Last modified
- 12 May 2026
- Contributors
- Praetorian; ExtraHop; Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
12
Threat groupsTop 15%
Threat groups85th percentile · 85% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Trusted Relationship MITRE reference T1199
Top 15%of all ATT&CK techniques for number of groups
12 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Sea TurtleG1041 ↗
Targeted third-party entities in trusted relationships with primary targets to ultimately achieve access at primary targets. Entities targeted included DNS registrars, telecommunication companies, and internet service providers.1
RedCurlG1039 ↗
Has gained access to a contractor to pivot to the victim’s infrastructure.1
POLONIUMG1005 ↗
Has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.1
LAPSUS$G1004 ↗
Has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.1
HAFNIUMG0125 ↗
Has used stolen API keys and credentials associated with privilege access management (PAM), cloud app providers, and cloud data management companies to access downstream customer environments.1
All 12 groups for this technique · 6 newest in this preview
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.12
All 1 campaigns for this technique
Offense vs defense T1199
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0
first rule: 2021 Q3 · 1 of 1 campaigns plottedTrusted Relationship detection strategy DET0488
MITRE names one behaviour worth catching for this technique and breaks it into 7 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect abuse of Trusted Relationships (third-party and delegated admin access)
7 platforms
AN1344 · Windows
Behavioral chain: (1) a login from a third-party account or untrusted source network establishes an interactive/remote session; (2) the session acquires elevated privileges or accesses sensitive resources atypical for that account; (3) subsequent lateral movement or data access occurs from the same session/device. Correlate Windows logon events, token elevation/privileged use, and resource access with third-party context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Logon Session MetadataDC0088 | WinEventLog:Security | EventCode=4776, 4771, 4770 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ThirdPartyCIDRs | Ranges used by MSPs/contractors/VPN egress; used to enrich logons and network flows. |
| ExpectedAdminHosts | Servers where third-party admins are allowed; deviations raise risk. |
| TimeWindow | Correlation window linking logon → elevation → access (e.g., 30–120 minutes). |
| HighValueResources | File shares/AD objects/servers that should never be touched by third-party sessions. |
AN1345 · Linux
Behavioral chain: (1) sshd or federated SSO logins from third-party networks or identities; (2) rapid sudo/su privilege elevation; (3) access to sensitive paths or east-west SSH. Correlate auth logs, process execution, and network flows.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session CreationDC0067 | linux:syslog | Accepted publickey/password for * from * port * ssh2 |
| Network Traffic ContentDC0085 | NSM:Flow | ssh connections originating from third-party CIDRs |
| Logon Session MetadataDC0088 | auditd:SYSCALL | execve,socket,connect,openat |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ThirdPartyUsers | POSIX accounts assigned to vendors/partners. |
| AllowedJumpHosts | Bastion hosts permitted for third-party access. |
| MFAExpected | Flag indicating whether PAM/MFA should be present; used to score risk. |
AN1346 · macOS
Behavioral chain: (1) third-party interactive login or mobileconfig-based device enrollment; (2) privilege use or admin group change; (3) lateral movement mounts/ssh. Correlate unified logs and network telemetry.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session CreationDC0067 | macos:unifiedlog | loginwindow or sshd successful login events |
| Network Traffic ContentDC0085 | NSM:Flow | ssh/smb connections to internal resources from third-party devices |
| Logon Session MetadataDC0088 | macos:unifiedlog | Group membership change for admin or wheel |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ManagedDeviceList | Known corp devices; treat unknown devices as higher risk. |
AN1347 · Identity Provider
Behavioral chain: (1) delegated admin or external identity establishes session (e.g., partner/reseller DAP, B2B guest, SAML/OAuth trust); (2) role elevation or app consent/permission grant; (3) downstream privileged actions in the tenant. Correlate IdP sign-in, admin/role assignment, and consent/admin-on-behalf events.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship |
| Logon Session CreationDC0067 | azure:signinlogs | InteractiveUser, ServicePrincipalSignIn |
| Logon Session MetadataDC0088 | azure:audit | Add delegated admin / Assign admin roles / Update application consent |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TrustedPartnerTenantIDs | Tenant IDs of approved partners; any others are suspicious. |
| RequiredMFA | Require MFA for partner sessions; alert on bypass or step-up failure. |
| RoleScopeAllowList | Roles third-parties may hold (e.g., Helpdesk Admin); flag broader scopes. |
AN1348 · IaaS
Behavioral chain: (1) cross-account or third-party principal assumes a role into the tenant/subscription/project; (2) privileged API calls are made in short succession; (3) access originates from unfamiliar networks or geos. Correlate assume-role/federation events with sensitive API usage.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | AWS:CloudTrail | CreateUser|AttachRolePolicy|CreateAccessKey|UpdateAssumeRolePolicy|CreateLoginProfile |
| Logon Session CreationDC0067 | AWS:CloudTrail | AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity |
| Logon Session MetadataDC0088 | gcp:audit | google.iam.credentials.generateAccessToken / serviceAccountTokenCreator |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ExternalAccountAllowList | Cross-account principals permitted to assume roles; used for allow-listing. |
| SensitiveAPIs | Provider-specific list of risky APIs for scoring. |
| GeoVelocityThreshold | Detect impossible travel between partner and tenant actions. |
AN1349 · SaaS
Behavioral chain: (1) third-party app or admin connects via OAuth/marketplace install; (2) high-privilege scopes granted; (3) anomalous actions (mass read/exports, admin changes).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | saas:googleworkspace | OAuth2 authorization grants / Admin role assignments |
| Logon Session MetadataDC0088 | saas:salesforce | ConnectedApp OAuth policy change / Login as user |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ApprovedApps | Catalog of sanctioned third-party apps and scopes. |
| ExportVolumeThreshold | Data export size/rate baselines to detect abnormal partner activity. |
AN1350 · Office Suite
Behavioral chain: (1) delegated administration offers/relationships created or modified by partner tenants; (2) mailbox delegation/impersonation enabled; (3) follow-on access from partner IPs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365:unified | Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship |
| Logon Session CreationDC0067 | azure:signinlogs | InteractiveUser, NonInteractiveUser |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MailboxDelegateAllowList | Specific mailboxes third-parties may manage. |
Require MFA for all delegated administrator accounts.
Network SegmentationM1030
Network segmentation can be used to isolate infrastructure components that do not require broad network access.
Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary. In Office 365 environments, partner relationships and roles can be viewed under the “Partner Relationships” page.