Trusted Relationship

What is Trusted Relationship?

“Trusted Relationship is documented as technique T1199 in MITRE ATT&CK® v19.1 under the Initial Access tactic. Detection requires visibility into SIEM, Firewall telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Trusted Relationship activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Maintain an inventory of all third-party accounts and connections with their associated business justifications, and periodically audit these accounts to confirm they are still required and have not been over-provisioned with unnecessary permissions.

2. 2

   Monitor authentication events from third-party accounts and alert on logins occurring outside scheduled maintenance windows, logins from IP addresses not associated with the partner organization, and access to systems beyond the partner scope of support.

3. 3

   Implement just-in-time access for vendor and partner accounts so that credentials are only activated for the duration of authorized work sessions, reducing the window of opportunity if a partner account is compromised.

4. 4

   Alert on lateral movement originating from systems or accounts associated with managed service providers or other trusted partners, as legitimate support activities rarely require moving between systems in patterns consistent with reconnaissance.

5. 5

   Review network segmentation controls that apply to trusted third-party connections to ensure partners only have network-level access to the specific systems they support, limiting the blast radius if a partner account is used maliciously.

Example Alerts

These realistic alert examples show what Trusted Relationship looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Trusted Relationship?

Detection centers on SIEM, Firewall telemetry for the initial access phase of the attack. Maintain an inventory of all third-party accounts and connections with their associated business justifications, and periodically audit these accounts to confirm they are still required and have not been over-provisioned with unnecessary permissions. Monitor authentication events from third-party accounts and alert on logins occurring outside scheduled maintenance windows, logins from IP addresses not associated with the partner organization, and access to systems beyond the partner scope of support.

What does a Trusted Relationship alert look like?

A representative SIEM detection is "MSP Account Accessing Systems Outside Support Scope" (high severity): Managed service provider account msp_operations_user accessed the finance application server and HR directory systems over the past 3 hours. This account is authorized only for IT infrastructure management across server and networking equipment. The access to business application systems falls outside the contracted support scope and the MSP has not submitted any change requests for these systems.

Which tools detect Trusted Relationship, and how can I practice?

Trusted Relationship (T1199) is best surfaced with SIEM, Firewall telemetry, which exposes the initial access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.