Trusted Relationship (MITRE ATT&CK T1199) is initial access through an organization that already has access to the intended victim. The attacker breaches or uses a third party and rides the connection that third party has into your environment. MITRE files it under Initial Access and lists IaaS, Identity Provider, Linux, Office Suite, SaaS, Windows and macOS.
Those connections often get less scrutiny than your own front door.
How attackers use it
MITRE explains that organizations often give elevated access to second and third parties so they can manage internal systems and cloud environments. Examples include IT services contractors, managed security providers, and infrastructure contractors such as HVAC, elevators and physical security. The provider's access may be meant to be limited to what it maintains, but it may sit on the same network as everything else. That means valid accounts used by the other party can be compromised and used.
In Office 365, organizations may grant Microsoft partners or resellers delegated administrator permissions. If an adversary compromises a partner or reseller account, they may be able to use existing delegated administrator relationships, or send new delegated administrator offers to clients, to gain administrative control over the victim tenant.
The MITRE page lists many examples of groups moving from one organization to another, from IT and managed service providers into their customers, and of stolen API keys and credentials from privileged access management and cloud providers being used to reach downstream customers.
How to detect it
MITRE's detection strategy is a behavioral chain by platform, but the story is the same.
- Login from a third party. An account or source network that belongs to a third party starts an interactive or remote session.
- Escalation. The session gets elevated privileges or touches sensitive resources that are not typical for that account.
- Follow-on. Lateral movement or data access from the same session or device.
Platform specifics from MITRE:
- Windows. Correlate logon events, token elevation and privileged use, and resource access with third-party context.
- Linux. sshd or federated SSO logins from third-party networks or identities, rapid sudo or su, then access to sensitive paths or east-west SSH.
- Identity provider and SaaS. A delegated admin or external identity such as partner or reseller access, a B2B guest or a SAML or OAuth trust establishes a session, followed by a role elevation or app consent, then downstream privileged actions. Use sign-in, admin and role assignment, and consent events.
- Cloud. A cross-account or third-party principal assumes a role into a tenant, subscription or project, makes privileged API calls in quick succession, from unfamiliar networks or geographies.
- Marketplace apps. A third-party app or admin connects through OAuth or a marketplace install, high-privilege scopes are granted, and then anomalous actions such as mass read or export follow.
The lesson is to tag third-party identities in your logs, so you can ask a simple question: what did vendor accounts do last night?
How to reduce the risk
MITRE's mitigations:
- Require MFA for all delegated administrator accounts.
- Segment the network to isolate infrastructure components that do not need broad access.
- Manage accounts and permissions used by parties in trusted relationships so the damage is limited if the party is compromised. In Office 365, you can see partner relationships and roles on the Partner Relationships page.
Check your own environment
- Do you have a list of every third party with access to your network, tenants, cloud accounts and SaaS tools?
- For each, what is the access, who approved it, and when was it last reviewed?
- Is MFA enforced on every vendor and delegated administrator account?
- Is vendor access limited in time and in scope, or standing and broad?
- Can you see what a vendor account did in the last week?
- In Microsoft 365, have you looked at the Partner Relationships page recently?
Quick check
Why might a trusted relationship be easier to abuse than a normal entry point?
The access is expected and may get less scrutiny than standard routes. The provider's access may also sit on the same network as the rest of the enterprise.
Which Office 365 feature does MITRE call out?
Delegated administrator permissions granted to Microsoft partners or resellers, which an adversary may abuse after compromising a partner or reseller account.
