Trusted Relationship

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.^[1]

ID: T1199

Sub-techniques: No sub-techniques

ⓘ

Tactic: Initial Access

ⓘ

Platforms: IaaS, Linux, SaaS, Windows, macOS

Contributors: Praetorian

Version: 2.2

Created: 18 April 2018

Last Modified: 08 March 2021

Version Permalink

Live Version

Procedure Examples

ID	Name	Description
G0007	APT28	Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.^[2]
G0016	APT29	APT29 has used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.^[3]
G0115	GOLD SOUTHFIELD	GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.^[4]
G0045	menuPass	menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.^[5]^[6]^[7]^[8]^[9]
G0034	Sandworm Team	Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.^[10]

Mitigations

ID	Mitigation	Description
M1030	Network Segmentation	Network segmentation can be used to isolate infrastructure components that do not require broad network access.
M1052	User Account Control	Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary.

Detection

ID	Data Source	Data Component
DS0015	Application Log	Application Log Content
DS0028	Logon Session	Logon Session Creation
		Logon Session Metadata

Establish monitoring for activity conducted by second and third party providers and other trusted entities that may be leveraged as a means to gain access to the network. Depending on the type of relationship, an adversary may have access to significant amounts of information about the target before conducting an operation, especially if the trusted relationship is based on IT services. Adversaries may be able to act quickly towards an objective, so proper monitoring for behavior related to Credential Access, Lateral Movement, and Collection will be important to detect the intrusion.

Trusted Relationship

Procedure Examples

Mitigations

Detection

References