{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1199","id":"T1199","name":"Trusted Relationship","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1199","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"dec3f7c053a0fd9f471f26ebff05abaf1531946ec54f0da71392e9654367deda","description":"Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.\n\nOrganizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers)\n\nIn Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.(Citation: Office 365 Delegated Administration)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1199","external_id":"T1199"},{"source_name":"CISA IT Service Providers","description":"CISA. (n.d.). APTs Targeting IT Service Provider Customers. Retrieved November 16, 2020.","url":"https://us-cert.cisa.gov/APTs-Targeting-IT-Service-Provider-Customers"},{"source_name":"Office 365 Delegated Administration","description":"Microsoft. (n.d.). Partners: Offer delegated administration. Retrieved May 27, 2022.","url":"https://support.microsoft.com/en-us/topic/partners-offer-delegated-administration-26530dc0-ebba-415b-86b1-b55bc06b073e?ui=en-us&rs=en-us&ad=us"}],"platforms":["IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"enterprise/T1199","id":"T1199","name":"Trusted Relationship","domain":"enterprise","platforms":["IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","identity","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1199","technique_page":"techniques/enterprise/T1199/","page":"detections/enterprise/T1199/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":7,"live_validated":0},"sigma_rules":[{"id":"ff246f56-7f24-402a-baca-b86540e3925c","title":"Microsoft 365 - User Restricted from Sending Email","status":"test","level":"medium","logsource":{"service":"threat_management","product":"m365"},"data_path":"data/detection-rules/ff246f56-7f24-402a-baca-b86540e3925c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml","author":"austinsonger","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0488","name":"Detect abuse of Trusted Relationships (third-party and delegated admin access)","url":"https://attack.mitre.org/detectionstrategies/DET0488","stix_id":"x-mitre-detection-strategy--2f7a5ebd-e025-4822-aed2-46fc3ec1a0a9","relationship_id":"relationship--8dcb3689-54f5-4416-9b75-6c380d24bdca","description":"","analytics":[{"id":"AN1344","name":"Analytic 1344","guidance":"Behavioral chain: (1) a login from a third-party account or untrusted source network establishes an interactive/remote session; (2) the session acquires elevated privileges or accesses sensitive resources atypical for that account; (3) subsequent lateral movement or data access occurs from the same session/device. Correlate Windows logon events, token elevation/privileged use, and resource access with third-party context.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1344","platforms":["Windows"],"tuning":[{"field":"ThirdPartyCIDRs","description":"Ranges used by MSPs/contractors/VPN egress; used to enrich logons and network flows."},{"field":"ExpectedAdminHosts","description":"Servers where third-party admins are allowed; deviations raise risk."},{"field":"TimeWindow","description":"Correlation window linking logon → elevation → access (e.g., 30–120 minutes)."},{"field":"HighValueResources","description":"File shares/AD objects/servers that should never be touched by third-party sessions."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"WinEventLog:Security","channel":"EventCode=4624, 4648","platforms":["Windows"],"analytic_id":"AN1344","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1344","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"WinEventLog:Security","channel":"EventCode=4776, 4771, 4770","platforms":["Windows"],"analytic_id":"AN1344","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1344","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN1344","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1344","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0038","component":"Application Log Content","name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","platforms":["Windows"],"analytic_id":"AN1344","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1344","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1345","name":"Analytic 1345","guidance":"Behavioral chain: (1) sshd or federated SSO logins from third-party networks or identities; (2) rapid sudo/su privilege elevation; (3) access to sensitive paths or east-west SSH. Correlate auth logs, process execution, and network flows.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1345","platforms":["Linux"],"tuning":[{"field":"ThirdPartyUsers","description":"POSIX accounts assigned to vendors/partners."},{"field":"AllowedJumpHosts","description":"Bastion hosts permitted for third-party access."},{"field":"MFAExpected","description":"Flag indicating whether PAM/MFA should be present; used to score risk."}],"log_sources":[{"component_id":"DC0088","component":"Logon Session Metadata","name":"auditd:SYSCALL","channel":"execve,socket,connect,openat","platforms":["Linux"],"analytic_id":"AN1345","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1345","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"linux:syslog","channel":"Accepted publickey/password for * from * port * ssh2","platforms":["Linux"],"analytic_id":"AN1345","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1345","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"ssh connections originating from third-party CIDRs","platforms":["Linux"],"analytic_id":"AN1345","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1345","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1346","name":"Analytic 1346","guidance":"Behavioral chain: (1) third-party interactive login or mobileconfig-based device enrollment; (2) privilege use or admin group change; (3) lateral movement mounts/ssh. Correlate unified logs and network telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1346","platforms":["macOS"],"tuning":[{"field":"ManagedDeviceList","description":"Known corp devices; treat unknown devices as higher risk."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"macos:unifiedlog","channel":"loginwindow or sshd successful login events","platforms":["macOS"],"analytic_id":"AN1346","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1346","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"macos:unifiedlog","channel":"Group membership change for admin or wheel","platforms":["macOS"],"analytic_id":"AN1346","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1346","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"ssh/smb connections to internal resources from third-party devices","platforms":["macOS"],"analytic_id":"AN1346","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1346","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN1347","name":"Analytic 1347","guidance":"Behavioral chain: (1) delegated admin or external identity establishes session (e.g., partner/reseller DAP, B2B guest, SAML/OAuth trust); (2) role elevation or app consent/permission grant; (3) downstream privileged actions in the tenant. Correlate IdP sign-in, admin/role assignment, and consent/admin-on-behalf events.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1347","platforms":["Identity Provider"],"tuning":[{"field":"TrustedPartnerTenantIDs","description":"Tenant IDs of approved partners; any others are suspicious."},{"field":"RequiredMFA","description":"Require MFA for partner sessions; alert on bypass or step-up failure."},{"field":"RoleScopeAllowList","description":"Roles third-parties may hold (e.g., Helpdesk Admin); flag broader scopes."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"azure:signinlogs","channel":"InteractiveUser, ServicePrincipalSignIn","platforms":["Identity Provider"],"analytic_id":"AN1347","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1347","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"azure:audit","channel":"Add delegated admin / Assign admin roles / Update application consent","platforms":["Identity Provider"],"analytic_id":"AN1347","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1347","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship","platforms":["Identity Provider"],"analytic_id":"AN1347","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1347","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1348","name":"Analytic 1348","guidance":"Behavioral chain: (1) cross-account or third-party principal assumes a role into the tenant/subscription/project; (2) privileged API calls are made in short succession; (3) access originates from unfamiliar networks or geos. Correlate assume-role/federation events with sensitive API usage.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1348","platforms":["IaaS"],"tuning":[{"field":"ExternalAccountAllowList","description":"Cross-account principals permitted to assume roles; used for allow-listing."},{"field":"SensitiveAPIs","description":"Provider-specific list of risky APIs for scoring."},{"field":"GeoVelocityThreshold","description":"Detect impossible travel between partner and tenant actions."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"AWS:CloudTrail","channel":"AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity","platforms":["IaaS"],"analytic_id":"AN1348","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1348","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0038","component":"Application Log Content","name":"AWS:CloudTrail","channel":"CreateUser|AttachRolePolicy|CreateAccessKey|UpdateAssumeRolePolicy|CreateLoginProfile","platforms":["IaaS"],"analytic_id":"AN1348","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1348","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"gcp:audit","channel":"google.iam.credentials.generateAccessToken / serviceAccountTokenCreator","platforms":["IaaS"],"analytic_id":"AN1348","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1348","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"}]},{"id":"AN1349","name":"Analytic 1349","guidance":"Behavioral chain: (1) third-party app or admin connects via OAuth/marketplace install; (2) high-privilege scopes granted; (3) anomalous actions (mass read/exports, admin changes).","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1349","platforms":["SaaS"],"tuning":[{"field":"ApprovedApps","description":"Catalog of sanctioned third-party apps and scopes."},{"field":"ExportVolumeThreshold","description":"Data export size/rate baselines to detect abnormal partner activity."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"saas:googleworkspace","channel":"OAuth2 authorization grants / Admin role assignments","platforms":["SaaS"],"analytic_id":"AN1349","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1349","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"saas:salesforce","channel":"ConnectedApp OAuth policy change / Login as user","platforms":["SaaS"],"analytic_id":"AN1349","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1349","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"}]},{"id":"AN1350","name":"Analytic 1350","guidance":"Behavioral chain: (1) delegated administration offers/relationships created or modified by partner tenants; (2) mailbox delegation/impersonation enabled; (3) follow-on access from partner IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1350","platforms":["Office Suite"],"tuning":[{"field":"MailboxDelegateAllowList","description":"Specific mailboxes third-parties may manage."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship","platforms":["Office Suite"],"analytic_id":"AN1350","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1350","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"azure:signinlogs","channel":"InteractiveUser, NonInteractiveUser","platforms":["Office Suite"],"analytic_id":"AN1350","source_url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1350","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"Once [APT28](https://attack.mitre.org/groups/G0007) gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.(Citation: DOJ GRU Indictment Jul 2018)","relationship_id":"relationship--565d2d07-0e2e-44e5-bc37-5a64e49394ee","references":[{"source_name":"DOJ GRU Indictment Jul 2018","description":"Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.(Citation: MSTIC Nobelium Oct 2021)","relationship_id":"relationship--ae93611e-8520-4c12-8fbe-7437f33a4092","references":[{"source_name":"MSTIC Nobelium Oct 2021","description":"Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved March 25, 2022.","url":"https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"[Threat Group-3390](https://attack.mitre.org/groups/G0027) has compromised third party service providers to gain access to victim's environments.(Citation: Profero APT27 December 2020)","relationship_id":"relationship--690c6d2a-3e02-4eb9-b835-079c50c64adf","references":[{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.(Citation: US District Court Indictment GRU Unit 74455 October 2020) Additionally, [Sandworm Team](https://attack.mitre.org/groups/G0034) has accessed Internet service providers and telecommunication entities that provide mobile connectivity.(Citation: mandiant_apt44_unearthing_sandworm) ","relationship_id":"relationship--9528abfe-4897-4171-8e01-a0ceeb376a9a","references":[{"source_name":"mandiant_apt44_unearthing_sandworm","description":"Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) has used legitimate access granted to Managed Service Providers in order to access victims of interest.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)(Citation: Symantec Cicada November 2020)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)","relationship_id":"relationship--99a96ac0-c93d-488b-8439-04d97716682c","references":[{"source_name":"FireEye APT10 April 2017","description":"FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source_name":"Symantec Cicada November 2020","description":"Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"},{"source_name":"DOJ APT10 Dec 2018","description":"United States District Court Southern District of New York (USDC SDNY) . (2018, December 17). United States of America v. Zhu Hua and Zhang Shilong. Retrieved April 17, 2019.","url":"https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"},{"source_name":"District Court of NY APT10 Indictment December 2018","description":"US District Court Southern District of New York. (2018, December 17). United States v. Zhu Hua Indictment. Retrieved December 17, 2020.","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"id":"G0115","name":"GOLD SOUTHFIELD","url":"https://attack.mitre.org/groups/G0115","kind":"intrusion-set","description":"[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--1567be6a-0231-4605-b92b-ae1bc5e1bb4e","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has used stolen API keys and credentials associated with privilege access management (PAM), cloud app providers, and cloud data management companies to access downstream customer environments.(Citation: Microsoft Silk Typhoon MAR 2025)","relationship_id":"relationship--ca446484-9d2d-464d-bb17-88914d6f9b36","references":[{"source_name":"Microsoft Silk Typhoon MAR 2025","description":"Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.(Citation: MSTIC DEV-0537 Mar 2022)","relationship_id":"relationship--e2e2fb8d-6b89-4d49-bea9-cca54ae3e56d","references":[{"source_name":"MSTIC DEV-0537 Mar 2022","description":"MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"id":"G1005","name":"POLONIUM","url":"https://attack.mitre.org/groups/G1005","kind":"intrusion-set","description":"[POLONIUM](https://attack.mitre.org/groups/G1005) has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.(Citation: Microsoft POLONIUM June 2022)","relationship_id":"relationship--b0e3680e-6099-4f33-a45e-5e938a7e7085","references":[{"source_name":"Microsoft POLONIUM June 2022","description":"Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has gained access to a contractor to pivot to the victim’s infrastructure.(Citation: therecord_redcurl)","relationship_id":"relationship--a4ec9b64-726b-4f6e-9115-98653d2bf8d4","references":[{"source_name":"therecord_redcurl","description":"Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.","url":"https://therecord.media/redcurl-hackers-russian-bank-australian-company"}]},{"id":"G1041","name":"Sea Turtle","url":"https://attack.mitre.org/groups/G1041","kind":"intrusion-set","description":"[Sea Turtle](https://attack.mitre.org/groups/G1041) targeted third-party entities in trusted relationships with primary targets to ultimately achieve access at primary targets. Entities targeted included DNS registrars, telecommunication companies, and internet service providers.(Citation: Talos Sea Turtle 2019)","relationship_id":"relationship--ef3683c7-1514-4fa3-9c2d-477fb945982a","references":[{"source_name":"Talos Sea Turtle 2019","description":"Cisco Talos. (2019, April 17). Sea Turtle: DNS Hijacking Abuses Trust In Core Internet Service. Retrieved November 20, 2024.","url":"https://blog.talosintelligence.com/seaturtle/"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has leveraged compromised devices associated with trusted connections or those associated with private interconnections to include provider-to-provider or provider-to-customer relationships in order to pivot to target networks.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)  ","relationship_id":"relationship--f3f0d678-c173-4817-8f61-803d7a8cc2e7","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.(Citation: Check Point VOID MANTICORE Handala Hack March 2026)","relationship_id":"relationship--e59b9a1d-51cb-4ad8-b363-23ac4a7535ec","references":[{"source_name":"Check Point VOID MANTICORE Handala Hack March 2026","description":"Check Point Research. (2026, March 12). “Handala Hack” – Unveiling Group’s Modus Operandi. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has gained access to victim environments using trusted connections granted to third party partners, collaborators and contractors.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also leveraged trusted third-party services to include Citrix, VMware, Azure Virtual Desktop and Application Services to gain access to victim networks.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--1cfd8afe-772b-45ee-9c3d-58188b709bf4","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary. In Office 365 environments, partner relationships and roles can be viewed under the “Partner Relationships” page.(Citation: Office 365 Partner Relationships)\n","relationship_id":"relationship--a42398e2-3daa-452a-80f8-f06660328f18","references":[{"source_name":"Office 365 Partner Relationships","description":"Microsoft. (2022, March 4). Manage partner relationships. Retrieved May 27, 2022.","url":"https://docs.microsoft.com/en-us/microsoft-365/commerce/manage-partners?view=o365-worldwide"}]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Network segmentation can be used to isolate infrastructure components that do not require broad network access.","relationship_id":"relationship--f0e9a1f7-8600-4558-9d2e-91126c42b126","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Require MFA for all delegated administrator accounts.(Citation: Microsoft Nobelium Admin Privileges)","relationship_id":"relationship--884c3843-5065-4919-ad6e-0f77130b4d36","references":[{"source_name":"Microsoft Nobelium Admin Privileges","description":"Microsoft Threat Intelligence Center. (2021, October 25). NOBELIUM targeting delegated administrative privileges to facilitate broader attacks. Retrieved January 31, 2022.","url":"https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1199":"/ttp-simulation/techniques/enterprise/T1199/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1199","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}}]}}