T1199No distinct observable

Trusted Relationship

Initial AccessIaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

Every discriminator in the brief's analytics lives in a site-specific list (ThirdPartyCIDRs, ExpectedAdminHosts, ThirdPartyUsers, HighValueResources) -- the thing that makes a 4624 a trusted-relationship logon rather than a plain T1078 logon is the account's status as a vendor identity, and no field in any offered log source carries it. The one genuinely distinctive T1199 observable -- Office 365 delegated-admin (DAP) activity -- has no log source in the brief at all, despite Identity Provider/SaaS/Office Suite being listed platforms. Anything written here would either hardcode a placeholder CIDR/username or duplicate existing T1078 material.

What the technique is

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used. In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.

Read it on attack.mitre.org

What MITRE says you would watch

AN1344
Behavioral chain: (1) a login from a third-party account or untrusted source network establishes an interactive/remote session; (2) the session acquires elevated privileges or accesses sensitive resources atypical for that account; (3) subsequent lateral movement or data access occurs from the same session/device. Correlate Windows logon events, token elevation/privileged use, and resource access with third-party context.
AN1345
Behavioral chain: (1) sshd or federated SSO logins from third-party networks or identities; (2) rapid sudo/su privilege elevation; (3) access to sensitive paths or east-west SSH. Correlate auth logs, process execution, and network flows.
AN1346
Behavioral chain: (1) third-party interactive login or mobileconfig-based device enrollment; (2) privilege use or admin group change; (3) lateral movement mounts/ssh. Correlate unified logs and network telemetry.