THREATNOIR
Subscribe
MITRE ATT&CK · T1199

Trusted Relationship

MITRE · cited in 6 of our lessons

Explanation

What attackers do. Attackers compromise a third party that already has access to the target, such as a managed service provider, contractor or IT supplier, and use that trusted connection to get in. This serves the Initial Access tactic.

How to defend. Inventory third parties with access, give them least privilege and separate accounts, and require MFA and time-limited access. Monitor and log third-party sessions, and include supplier access in incident response plans. Write security requirements and breach notification duties into supplier contracts.

Signs to look for. Look for supplier accounts used outside agreed times or from unexpected locations, unusual actions by managed service tools, and access to systems outside the supplier's scope. A common gap is supplier access that is broad, permanent and unmonitored.

Open the technique on MITRE ATT&CK
The official text
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used. In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.