T1199 — Trusted Relationship

Tactic: Initial Access · Platforms: IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations…

Sigma detection rules (7)

title: T1199 Trusted Relationship
id: a26573dd-16ce-4d7c-8907-026119157429
description: 'Detects interactive or network logons using explicit alternate credentials, consistent with a third-party or delegated-admin account abusing a Trusted Relationship to access internal systems. (Data Component: Logon; baseline tier: windows-eventid.) Tune using: ThirdPartyCIDRs, ExpectedAdminHosts, TimeWindow, HighValueResources.'
references:
  - https://attack.mitre.org/techniques/T1199
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.initial-access
  - attack.t1199

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID:
      - '4624'
      - '4648'
    LogonType:
      - '3'
      - '10'
  filter_system_account:
    TargetUserName|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate remote administration or scheduled third-party maintenance windows from known vendor IP ranges — scope with ThirdPartyCIDRs/ExpectedAdminHosts to reduce noise.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account.

level: medium

title: T1199 Trusted Relationship
id: f3918507-43fd-4bf8-a1d9-c6c512501a24
description: 'Detect abuse of Trusted Relationships (third-party and delegated admin access). Raw auditd USER_LOGIN records expose only acct, uid, source address, and terminal, with no inherent third-party flag, so genuine trusted-relationship-abuse detection fundamentally requires a maintained vendor or contractor account inventory correlated with anomalous source IP or ASN data that auditd cannot supply on its own. This narrows the previous tautological any-successful-login match to successful logins by accounts matching an organization-maintained third-party or vendor account naming convention (tune the prefix list to the real naming scheme in use) instead of firing on all authentication. Tune using: ThirdPartyUsers, AllowedJumpHosts, MFAExpected.'
references:
  - https://attack.mitre.org/techniques/T1199
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.initial-access
  - attack.t1199

logsource:
  product: linux
  service: auditd

detection:
  selection_login:
    type: USER_LOGIN
    res: success
  selection_vendor_account:
    acct|startswith:
      - 'vendor-'
      - 'contractor-'
      - 'ext-'
      - 'thirdparty-'

  condition: selection_login and selection_vendor_account

falsepositives:
  - Any legitimate account that happens to match the vendor/contractor naming prefixes but is not actually a third-party account; the naming convention list must be kept current for this proxy to remain accurate.

level: low

title: T1199 Trusted Relationship
id: 6d6f78e7-cab6-4168-bb10-d09fe1321146
description: 'Detect abuse of Trusted Relationships (third-party and delegated admin access). (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ManagedDeviceList.'
references:
  - https://attack.mitre.org/techniques/T1199
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.initial-access
  - attack.t1199

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    ParentImage|endswith:
      - '/ARDAgent'
      - '/screensharingd'

  condition: selection

falsepositives:
  - Legitimate MSP or vendor remote-support sessions through approved remote management agents.

level: medium

title: T1199 Trusted Relationship
id: 70bd7edc-b478-4a73-aa91-e47f14dacc4d
description: 'Detect abuse of Trusted Relationships (third-party and delegated admin access). (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExternalAccountAllowList, SensitiveAPIs, GeoVelocityThreshold.'
references:
  - https://attack.mitre.org/techniques/T1199
author: Shahrukh Khan
date: 2026-05-02
license: MIT
tags:
  - attack.initial-access
  - attack.t1199

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'sts.amazonaws.com'
    eventName: 'AssumeRole'
  selection_external_account:
    requestParameters.roleArn|contains: 'arn:aws:iam::'
  filter_known_partner:
    requestParameters.roleArn|contains: '000000000000'

  condition: selection and selection_external_account and not filter_known_partner

falsepositives:
  - Legitimate managed service providers and SaaS integrations assume roles cross-account routinely, so this filter list of known partner account IDs must be maintained to avoid excessive noise.

level: high

title: T1199 Trusted Relationship
id: f304086b-4c9d-494c-a190-39d764f83a5f
description: 'Detect abuse of Trusted Relationships (third-party and delegated admin access). (Data Component: Application Log Content; baseline tier: fallback.) Tune using: ApprovedApps, ExportVolumeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1199
author: Shahrukh Khan
date: 2026-06-11
license: MIT
tags:
  - attack.initial-access
  - attack.t1199

logsource:
  product: saas
  service: googleworkspace

detection:
  selection_oauth_grant:
    events.name: 'oauth2_authorize'
  selection_ownership_transfer:
    events.name: 'transfer_document_ownership'

  condition: selection_oauth_grant or selection_ownership_transfer

falsepositives:
  - Approved third-party vendor apps completing a legitimate OAuth consent flow, or planned document ownership transfers during employee offboarding.

level: high

title: T1199 Trusted Relationship
id: 25be59e6-5abc-406b-8f8b-990ac89862d6
description: 'Detect abuse of Trusted Relationships (third-party and delegated admin access). (Data Component: Logon Session Creation; baseline tier: fallback.) Tune using: TrustedPartnerTenantIDs, RequiredMFA, RoleScopeAllowList.'
references:
  - https://attack.mitre.org/techniques/T1199
author: Shahrukh Khan
date: 2026-01-25
license: MIT
tags:
  - attack.initial-access
  - attack.t1199

logsource:
  product: azure
  service: signinlogs

detection:
  selection:
    ResultType: '0'
  external:
    AuthenticationRequirement: 'singleFactorAuthentication'
  crosstenant:
    UserPrincipalName|contains: '#EXT#'

  condition: selection and external and crosstenant

falsepositives:
  - Legitimate B2B guest collaboration where the partner tenant has not yet enforced multi factor authentication.

level: high

title: T1199 Trusted Relationship
id: 527f0b9f-b742-4744-9fea-a50c0b059753
description: 'Detect abuse of Trusted Relationships (third-party and delegated admin access). (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MailboxDelegateAllowList.'
references:
  - https://attack.mitre.org/techniques/T1199
author: Shahrukh Khan
date: 2026-01-19
license: MIT
tags:
  - attack.initial-access
  - attack.t1199

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation: 'Add-MailboxPermission'
  external:
    UserId|contains: '#EXT#'

  condition: selection and external

falsepositives:
  - Legitimate delegate access granted to an external consultant or managed service provider mailbox.

level: high

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1199 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan