Cross-source coverage

T1199 / ATT&CK

Trusted Relationship

14 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.

In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.

Tactics
Initial Access
Platforms
IaaS · Identity Provider · Linux · macOS · Office Suite · SaaS · Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:syslogNSM:Flowmacos:unifiedlogazure:signinlogsazure:auditm365:unifiedAWS:CloudTrailgcp:auditsaas:googleworkspacesaas:salesforce

How MITRE says to detect it DET0488

Detect abuse of Trusted Relationships (third-party and delegated admin access)

Windows Analytic 1344

Behavioral chain: (1) a login from a third-party account or untrusted source network establishes an interactive/remote session; (2) the session acquires elevated privileges or accesses sensitive resources atypical for that account; (3) subsequent lateral movement or data access occurs from the same session/device. Correlate Windows logon events, token elevation/privileged use, and resource access with third-party context.

  • WinEventLog:Security EventCode=4624, 4648
  • WinEventLog:Security EventCode=4776, 4771, 4770
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Security EventCode=4663, 4670, 4656

Linux Analytic 1345

Behavioral chain: (1) sshd or federated SSO logins from third-party networks or identities; (2) rapid sudo/su privilege elevation; (3) access to sensitive paths or east-west SSH. Correlate auth logs, process execution, and network flows.

  • auditd:SYSCALL execve,socket,connect,openat
  • linux:syslog Accepted publickey/password for * from * port * ssh2
  • NSM:Flow ssh connections originating from third-party CIDRs

macOS Analytic 1346

Behavioral chain: (1) third-party interactive login or mobileconfig-based device enrollment; (2) privilege use or admin group change; (3) lateral movement mounts/ssh. Correlate unified logs and network telemetry.

  • macos:unifiedlog loginwindow or sshd successful login events
  • macos:unifiedlog Group membership change for admin or wheel
  • NSM:Flow ssh/smb connections to internal resources from third-party devices

Identity Provider Analytic 1347

Behavioral chain: (1) delegated admin or external identity establishes session (e.g., partner/reseller DAP, B2B guest, SAML/OAuth trust); (2) role elevation or app consent/permission grant; (3) downstream privileged actions in the tenant. Correlate IdP sign-in, admin/role assignment, and consent/admin-on-behalf events.

  • azure:signinlogs InteractiveUser, ServicePrincipalSignIn
  • azure:audit Add delegated admin / Assign admin roles / Update application consent
  • m365:unified Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship

IaaS Analytic 1348

Behavioral chain: (1) cross-account or third-party principal assumes a role into the tenant/subscription/project; (2) privileged API calls are made in short succession; (3) access originates from unfamiliar networks or geos. Correlate assume-role/federation events with sensitive API usage.

  • AWS:CloudTrail AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity
  • AWS:CloudTrail CreateUser|AttachRolePolicy|CreateAccessKey|UpdateAssumeRolePolicy|CreateLoginProfile
  • gcp:audit google.iam.credentials.generateAccessToken / serviceAccountTokenCreator

SaaS Analytic 1349

Behavioral chain: (1) third-party app or admin connects via OAuth/marketplace install; (2) high-privilege scopes granted; (3) anomalous actions (mass read/exports, admin changes).

  • saas:googleworkspace OAuth2 authorization grants / Admin role assignments
  • saas:salesforce ConnectedApp OAuth policy change / Login as user

Office Suite Analytic 1350

Behavioral chain: (1) delegated administration offers/relationships created or modified by partner tenants; (2) mailbox delegation/impersonation enabled; (3) follow-on access from partner IPs.

  • m365:unified Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship
  • azure:signinlogs InteractiveUser, NonInteractiveUser

View on attack.mitre.org ↗

panther-labs/panther-analysis

6 rules
Detection Severity Format
Okta Identity Provider Created or Modified High Panther Python
Okta Identity Provider Sign-in High Panther Python
Okta Support Reset Credential High Panther Python
AppOmni Alert Passthrough Medium Panther Python
Okta Support Access Granted Medium Panther Python
Salesforce Third-Party Integration Monitoring Medium Panther Python

elastic/detection-rules

5 rules
Detection Severity Format
Entra ID Illicit Consent Grant via Registered Application Medium Elastic TOML
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource Medium Elastic TOML
Entra ID OAuth Phishing via First-Party Microsoft Application Medium Elastic TOML
New GitHub App Installed Medium Elastic TOML
Okta Sign-In Events via Third-Party IdP Medium Elastic TOML

SigmaHQ/sigma

2 rules
Detection Severity Format
Microsoft 365 - User Restricted from Sending Email Medium Sigma
Okta Session Impersonation Granted From Untrusted Domain Medium Sigma

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Anomalous login followed by Teams action Medium KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.