Trusted Relationship

What is Trusted Relationship?

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard employee accounts. Organizations frequently grant elevated network access to managed service providers, IT contractors, auditors, vendors, and business partners to perform legitimate business functions. These trusted relationships create an indirect attack surface because each third-party organization with network access represents a potential compromise path into the victim environment. Attackers who compromise a managed service provider can simultaneously access all of that provider's clients, as demonstrated by multiple high-profile supply chain attacks against MSPs. The challenge for defenders is that connections from trusted partners often use legitimate credentials, arrive from known IP ranges, and perform activities consistent with their business purpose, making it difficult to distinguish malicious access from authorized support activity.

“Trusted Relationship is documented as technique T1199 in the MITRE ATT&CK knowledge base under the Initial Access tactic. Detection requires visibility into SIEM, Firewall telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Trusted Relationship activity. These methods apply across SIEM, Firewall environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Maintain an inventory of all third-party accounts and connections with their associated business justifications, and periodically audit these accounts to confirm they are still required and have not been over-provisioned with unnecessary permissions.

2. 2

   Monitor authentication events from third-party accounts and alert on logins occurring outside scheduled maintenance windows, logins from IP addresses not associated with the partner organization, and access to systems beyond the partner scope of support.

3. 3

   Implement just-in-time access for vendor and partner accounts so that credentials are only activated for the duration of authorized work sessions, reducing the window of opportunity if a partner account is compromised.

4. 4

   Alert on lateral movement originating from systems or accounts associated with managed service providers or other trusted partners, as legitimate support activities rarely require moving between systems in patterns consistent with reconnaissance.

5. 5

   Review network segmentation controls that apply to trusted third-party connections to ensure partners only have network-level access to the specific systems they support, limiting the blast radius if a partner account is used maliciously.

Example Alerts

These realistic alert examples show what Trusted Relationship looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Trusted Relationship?

SOC analysts detect Trusted Relationship (T1199) by monitoring SIEM, Firewall telemetry for behavioral anomalies and specific indicators. Key detection methods include maintain an inventory of all third-party accounts and connections with their associated business justifications, and periodically audit these accounts. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Trusted Relationship?

Trusted Relationship can be detected using SIEM, Firewall platforms. SIEM tools are particularly effective for this technique because they provide visibility into the initial access phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Trusted Relationship in real-world attacks?

Trusted Relationship is a well-documented MITRE ATT&CK technique in the Initial Access tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Trusted Relationship scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Trusted Relationship for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Initial Access techniques like Trusted Relationship. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.