T1199 Trusted Relationship Mappings

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers)

In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.(Citation: Office 365 Delegated Administration)



Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-03 Access Enforcement Protects T1199 Trusted Relationship
AC-04 Information Flow Enforcement Protects T1199 Trusted Relationship
AC-06 Least Privilege Protects T1199 Trusted Relationship
AC-08 System Use Notification Protects T1199 Trusted Relationship
CM-06 Configuration Settings Protects T1199 Trusted Relationship
CM-07 Least Functionality Protects T1199 Trusted Relationship
SC-46 Cross Domain Policy Enforcement Protects T1199 Trusted Relationship
SC-07 Boundary Protection Protects T1199 Trusted Relationship
ME-RBAC-E3 Role Based Access Control Technique Scores T1199 Trusted Relationship
DO365-AG-E5 App Governance Technique Scores T1199 Trusted Relationship
DO365-ATH-E5 Advanced Threat Hunting Technique Scores T1199 Trusted Relationship