[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1199":3},{"item":4,"lessons":18,"controls":44,"related":72},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1199","T1199","Trusted Relationship",6,"MITRE","**What attackers do.** Attackers compromise a third party that already has access to the target, such as a managed service provider, contractor or IT supplier, and use that trusted connection to get in. This serves the Initial Access tactic.\n\n**How to defend.** Inventory third parties with access, give them least privilege and separate accounts, and require MFA and time-limited access. Monitor and log third-party sessions, and include supplier access in incident response plans. Write security requirements and breach notification duties into supplier contracts.\n\n**Signs to look for.** Look for supplier accounts used outside agreed times or from unexpected locations, unusual actions by managed service tools, and access to systems outside the supplier's scope. A common gap is supplier access that is broad, permanent and unmonitored.","Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.\n\nOrganizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.\n\nIn Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1199\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":25,"title":26,"published_at":27},"asos-saas-breach-one-compromised-identity-opens-the-door","ASOS SaaS Breach: One Compromised Identity Opens the Door","2026-10-09T22:20:25.762+00:00",{"slug":29,"title":30,"published_at":31},"ai-driven-autonomous-cyberattack-targets-taiwan-government","AI-Driven Autonomous Cyberattack Targets Taiwan Government","2026-08-12T18:20:23.539+00:00",{"slug":33,"title":34,"published_at":35},"n-central-auth-bypass-flaw-actively-exploited-msps-at-risk-of-cascading-compromise","N-central Auth Bypass Flaw Actively Exploited — MSPs at Risk of Cascading Compromise","2026-08-03T18:20:43.457+00:00",{"slug":37,"title":38,"published_at":39},"golden-chickens-maas-evolves-with-modular-malware-arsenal","Golden Chickens MaaS Evolves With Modular Malware Arsenal","2026-07-24T13:20:36.754+00:00",{"slug":41,"title":42,"published_at":43},"iran-linked-apt-exploits-it-supply-chain-with-modular-cc-framework","Iran-Linked APT Exploits IT Supply Chain with Modular C&C Framework","2026-07-07T14:22:18.841+00:00",[45,50,54,59,63,67],{"slug":46,"name":47,"problem":48,"stories":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":51,"name":52,"problem":53,"stories":49},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":55,"name":56,"problem":57,"stories":58},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":60,"name":61,"problem":62,"stories":58},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":64,"name":65,"problem":66,"stories":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":68,"name":69,"problem":70,"stories":71},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",1,[73,79,84,88,92,96,100,104],{"family":74,"item":75,"code":76,"title":77,"together":78},"cis","12","Control 12","Network Infrastructure Management",4,{"family":80,"item":81,"code":82,"title":83,"together":49},"nist-sp","800-161","SP 800-161","SP 800-161 Rev. 1: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations",{"family":5,"item":85,"code":86,"title":87,"together":49},"t1078","T1078","Valid Accounts",{"family":74,"item":89,"code":90,"title":91,"together":49},"17","Control 17","Incident Response Management",{"family":74,"item":93,"code":94,"title":95,"together":49},"13","Control 13","Network Monitoring and Defense",{"family":74,"item":97,"code":98,"title":99,"together":49},"5","Control 5","Account Management",{"family":101,"item":102,"code":103,"title":99,"together":49},"nist-800-53","ac-2","AC-2",{"family":105,"item":106,"code":107,"title":108,"together":58},"gdpr","32","Article 32","Security of processing"]