[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1199":3},{"item":4,"lessons":18,"controls":57,"related":84},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1199","T1199","Trusted Relationship",6,"MITRE","**What attackers do.** Attackers compromise a third party that already has access to the target, such as a managed service provider, contractor or IT supplier, and use that trusted connection to get in. This serves the Initial Access tactic.\n\n**How to defend.** Inventory third parties with access, give them least privilege and separate accounts, and require MFA and time-limited access. Monitor and log third-party sessions, and include supplier access in incident response plans. Write security requirements and breach notification duties into supplier contracts.\n\n**Signs to look for.** Look for supplier accounts used outside agreed times or from unexpected locations, unusual actions by managed service tools, and access to systems outside the supplier's scope. A common gap is supplier access that is broad, permanent and unmonitored.","Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.\n\nOrganizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.\n\nIn Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1199\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},9,[21,25,29,33,37,41,45,49,53],{"slug":22,"title":23,"published_at":24},"compromised-third-party-aws-credentials-enable-multi-tenant-cloud-breach","Compromised Third-Party AWS Credentials Enable Multi-Tenant Cloud Breach","2026-11-10T20:20:43.362+00:00",{"slug":26,"title":27,"published_at":28},"compromised-third-party-iam-credentials-enable-cross-account-aws-secret-theft","Compromised Third-Party IAM Credentials Enable Cross-Account AWS Secret Theft","2026-11-09T20:20:24.804+00:00",{"slug":30,"title":31,"published_at":32},"grey-market-ai-relay-service-hijacks-enterprise-codex-and-claude-code-deployments","Grey Market AI Relay Service Hijacks Enterprise Codex and Claude Code Deployments","2026-10-30T09:20:26.217+00:00",{"slug":34,"title":35,"published_at":36},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":38,"title":39,"published_at":40},"asos-saas-breach-one-compromised-identity-opens-the-door","ASOS SaaS Breach: One Compromised Identity Opens the Door","2026-10-09T22:20:25.762+00:00",{"slug":42,"title":43,"published_at":44},"ai-driven-autonomous-cyberattack-targets-taiwan-government","AI-Driven Autonomous Cyberattack Targets Taiwan Government","2026-08-12T18:20:23.539+00:00",{"slug":46,"title":47,"published_at":48},"n-central-auth-bypass-flaw-actively-exploited-msps-at-risk-of-cascading-compromise","N-central Auth Bypass Flaw Actively Exploited — MSPs at Risk of Cascading Compromise","2026-08-03T18:20:43.457+00:00",{"slug":50,"title":51,"published_at":52},"golden-chickens-maas-evolves-with-modular-malware-arsenal","Golden Chickens MaaS Evolves With Modular Malware Arsenal","2026-07-24T13:20:36.754+00:00",{"slug":54,"title":55,"published_at":56},"iran-linked-apt-exploits-it-supply-chain-with-modular-cc-framework","Iran-Linked APT Exploits IT Supply Chain with Modular C&C Framework","2026-07-07T14:22:18.841+00:00",[58,63,67,72,76,80],{"slug":59,"name":60,"problem":61,"stories":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",4,{"slug":64,"name":65,"problem":66,"stories":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":68,"name":69,"problem":70,"stories":71},"patch-management","Automated patch management","Known holes get closed in days, not months.",2,{"slug":73,"name":74,"problem":75,"stories":71},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":77,"name":78,"problem":79,"stories":71},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":81,"name":82,"problem":83,"stories":71},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[85,90,94,98,103,108,112,116],{"family":86,"item":87,"code":88,"title":89,"together":62},"cis","5","Control 5","Account Management",{"family":91,"item":92,"code":93,"title":89,"together":62},"nist-800-53","ac-2","AC-2",{"family":86,"item":95,"code":96,"title":97,"together":62},"12","Control 12","Network Infrastructure Management",{"family":99,"item":100,"code":101,"title":102,"together":62},"gdpr","32","Article 32","Security of processing",{"family":86,"item":104,"code":105,"title":106,"together":107},"13","Control 13","Network Monitoring and Defense",3,{"family":5,"item":109,"code":110,"title":111,"together":107},"t1078","T1078","Valid Accounts",{"family":86,"item":113,"code":114,"title":115,"together":107},"17","Control 17","Incident Response Management",{"family":91,"item":117,"code":118,"title":119,"together":107},"ac-6","AC-6","Least Privilege"]